Live › vulnerability › CVE-2026-117635
The `/api/v1/admin` routes did not enforce the public-only restriction on personal access tokens. A public-only token with admin scope could list private organizations and user email addresses, create organizations, obtain runner registration tokens, and create site administrator accounts that remain after the token is revoked.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 10:49 UTC. All times on this page are UTC.
Teams running a self-hosted code hosting server with personal access tokens and an admin API are exposed when a site administrator has issued a public-only token with admin scope. Tokens of users who are not site administrators cannot reach these routes, so those deployments are not affected by this path. The sources do not name the product or the affected version range.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The /api/v1/admin route group did not enforce the public-only restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.
This page as .md · .json · in your agent: get_signal("CVE-2026-117635")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.