Gitea user and organization feed token scope bypass
Summary
| CVE | CVE-2026-119625 |
|---|---|
| State | PUBLISHED |
| Assigner | Gitea |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-01 10:18:36 UTC |
| Updated | 2026-11-01 10:18:37 UTC |
| Description | The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site administrator's token this applied to every account. Tokens are now accepted on this route only for feeds, which require `read:user` or `read:organization`. |
Risk And Classification
EPSS: 0.001940000 probability, percentile 0.090780000 (date 2026-11-02)
Problem Types: CWE-863 | CWE-863 CWE-863: Incorrect Authorization
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/go-gitea/gitea/security/advisories/GHSA-3fv3-hhmm-4x2q | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| blog.gitea.com/release-of-28.3.0 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | blog.gitea.com | |
| github.com/go-gitea/gitea/pull/40115 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/releases/tag/v28.3.0 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/pull/39945 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: https://github.com/carfeii (en)
CNA: https://github.com/DshtAnger (en)
CNA: https://github.com/manus-pi (en)
CNA: https://github.com/cruzzer (en)
CNA: https://github.com/lunny (en)
CNA: https://github.com/bircni (en)
There are currently no legacy QID mappings associated with this CVE.