4.3
Medium
CVE-2026-27761 Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token…
Description
Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Gitea Open Source Git Server 1.26 | earliest → 1.26.2 | No fix stated |
References
- GitHub Security Advisory github.com
- GitHub Pull Request #38147 github.com
- Gitea v1.26.3 Release github.com
- Gitea v1.26.4 Release Blog Post blog.gitea.com
Timeline
- Published
- Last modified
Other CVEs of Gitea Open Source Git Server
The 97 CVEs of Gitea Open Source Git Server →
CVE-2026-24791
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
8.1
High
CVE-2026-24059
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents)…
6.5
Medium
CVE-2026-59765
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
7.5
High
CVE-2026-58510
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on…
4.3
Medium