PT-2026-63282 · Gitea · Gitea
CVE-2026-56443
·
Published
2026-07-21
·
Updated
2026-07-22
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Gitea version 1.26.2
Description
A bypass exists for the
public-only Personal Access Token (PAT) scope when the owner's visibility is set to Limited (instance-internal). While other scope categories correctly reject Limited owners, the Repository and Package categories only check if the resource is private, failing to account for Limited visibility. This allows a token with public-only scope to access content that should be restricted to internal users, exceeding the reach of an anonymous user.Technical details include the following affected areas:
- API Endpoints: API v1 packages, all 24 native package registries via
/api/packages/<type>/..., all API v1 Repository-category endpoints (including content, issues, PRs, releases, labels, and milestones), and web download endpoints such as/raw,/media, and/attachments, as well as LFS routes. - Vulnerable Parameters or Variables:
public-onlyPAT scope. - Function Names:
checkTokenPublicOnly(),reqPackageAccess(),TokenCanAccessRepo(), andCheckTokenScopes().
Recommendations
Update Gitea to a version where the following changes are implemented:
- In
checkTokenPublicOnly()andreqPackageAccess(), change the visibility check fromIsPrivate()to!IsPublic()for package owners. - In
TokenCanAccessRepo(), ensure the check validates that the repository owner's visibility is public whenpublic-onlyis active. - In
CheckTokenScopes(), update the logic to forbid access if the repository is private or if the owner's visibility is not public. As a temporary workaround, restrict the use of thepublic-onlyPAT scope for users accessing resources owned by accounts with Limited visibility.
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitea