Live › vulnerability › CVE-2026-118395
Gitea 1.27.3 blocked tokens restricted to public resources from creating repositories on some API routes, but several other routes still accepted them. A holder of such a token with write scopes could create private repositories, private organizations and repositories generated from templates, though it still could not read those private repositories.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 10:49 UTC. All times on this page are UTC.
Teams that run a self-hosted Gitea instance and issue personal access tokens restricted to public resources with write scopes. The flaw lets such a token create private content on routes the 1.27.3 fix missed, so instances without public-only tokens are unlikely to be exposed. Hosted Gitea users are affected only if their provider runs a vulnerable version.
No product ranges from the sources yet.
gitea --version or the admin dashboard and compare it against the fixed release.public-only in user settings or the admin token list, and check whether any holder has write scopes.POST /api/v1/org/{org}/repos, POST /api/v1/orgs/{org}/repos, POST /api/v1/orgs or POST /api/v1/repos/{owner}/{repo}/generate made with a public-only token.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Gitea 1.27.3 stopped personal access tokens restricted to public resources (public-only) from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/{org}/repos, POST /api/v1/orgs/{org}/repos, POST /api/v1/orgs and POST /api/v1/repos/{owner}/{repo}/generate still accepted such tokens. A holder of a public-only token with the needed write scopes could create private repositories in organizations where the token's owner may create repositories, create private organizations, and generate private repositories from templates. The token still could not read the private repositories it created.
This page as .md · .json · in your agent: get_signal("CVE-2026-118395")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.