---
id: CVE-2026-118395
title: Gitea public-only token bypass in repository and organization creation
summary: >-
  Gitea 1.27.3 stopped personal access tokens restricted to public resources
  (`public-only`) from creating repositories through `POST /api/v1/user/repos`
  and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST
  /api/v1/o…
severity: none
vendor: Gitea
product: gitea.dev
affected:
  - gitea.dev < 28.3.0
published: '2026-11-01'
updated: '2026-11-01'
sourceUpdated: '2026-11-01T09:48:51.036Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118395'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-x5v4-836g-f95x'
    label: GitHub Security Advisory GHSA-x5v4-836g-f95x
  - url: 'https://github.com/go-gitea/gitea/pull/39690'
    label: 'Fix: go-gitea/gitea pull request #39690'
  - url: 'https://github.com/go-gitea/gitea/pull/39853'
    label: 'Fix backport to release/v28: go-gitea/gitea pull request #39853'
  - url: 'https://blog.gitea.com/release-of-28.3.0/'
    label: Gitea 28.3.0 release announcement
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v28.3.0'
    label: go-gitea/gitea v28.3.0 release
tags:
  - cve.org
epss: 0.00157
epssPercentile: 0.04849
ingestedAt: '2026-11-05T18:28:50.709Z'
---

## Overview

Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POST /api/v1/orgs` and `POST /api/v1/repos/{owner}/{repo}/generate` still accepted such tokens. A holder of a public-only token with the needed write scopes could create private repositories in organizations where the token's owner may create repositories, create private organizations, and generate private repositories from templates. The token still could not read the private repositories it created.

## Affected

- `gitea.dev < 28.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.