–
Not scored
CVE-2026-119625
Gitea user and organization feed token scope bypass
gitea.dev · Incorrect authorization · CWE-863Affectedgitea.dev
FixUpdate to 28.3.0 or newer
PublishedNov 1, 09:48 · Gitea
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site administrator's token this applied to every account. Tokens are now accepted on this route only for feeds, which require `read:user` or `read:organization`.
From Gitea
Affected and fixed versions
ProductAffectedFixed ingitea.devbefore 28.3.028.3.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known