---
id: "CVE-2026-118395"
kind: "vulnerability"
aliases: ["CVE-2026-118395"]
title: "Gitea: public-only tokens could still create private repositories and organizations"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gitea", "package", "personal-access-tokens", "self-hosted"]
not_affected_if: ["managed-hosting", "no-public-only-tokens"]
published_at: "2026-11-01T10:18:36+00:00"
first_seen_at: "2026-11-01T10:49:33+00:00"
updated_at: "2026-11-01T10:51:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118395", "first_seen_at": "2026-11-01T10:49:33+00:00"}]
---

# Gitea: public-only tokens could still create private repositories and organizations

Gitea 1.27.3 blocked tokens restricted to public resources from creating repositories on some API routes, but several other routes still accepted them. A holder of such a token with write scopes could create private repositories, private organizations and repositories generated from templates, though it still could not read those private repositories.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Gitea version with `gitea --version` or the admin dashboard and compare it against the fixed release.
- Look for personal access tokens scoped to `public-only` in user settings or the admin token list, and check whether any holder has write scopes.
- Review audit or API logs for calls to `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POST /api/v1/orgs` or `POST /api/v1/repos/{owner}/{repo}/generate` made with a public-only token.

## Timeline

- 2026-11-01T10:49:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118395

## From the sources

Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POST /api/v1/orgs` and `POST /api/v1/repos/{owner}/{repo}/generate` still accepted such tokens. A holder of a public-only token with the needed write scopes could create private repositories in organizations where the token's owner may create repositories, create private organizations, and generate private repositories from templates. The token still could not read the private repositories it created.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_