Live › vulnerability › CVE-2026-119441
A DELETE API route that removes all repositories of an organization checked only whether the organization was public, not whether the caller's access token was restricted to public resources. A public-only access token belonging to an owner of a public organization could therefore permanently delete that organization's private repositories.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 10:49 UTC. All times on this page are UTC.
Sources describe a self-hosted or hosted code-hosting API where organization owners can use public-only access tokens. Teams running such a server with public organizations and private repositories are exposed; instances with no public organizations or no owners issuing public-only tokens are less likely to be affected. Exact affected versions are unknown from the sources.
No product ranges from the sources yet.
DELETE /api/v1/orgs/{org}/repos in the product's version and check whether it is in useUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DELETE /api/v1/orgs/{org}/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently delete the organization's private repositories, which such a token must not reach. Routes that require organization ownership now reject public-only tokens.
This page as .md · .json · in your agent: get_signal("CVE-2026-119441")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.