CVE-2026-20706
CRITICAL
CVSS 9.1
code.gitea.io/gitea
Verified Advisory
Token scope bypass on archive download endpoint in Gitea (CVE-2026-20706)
The `/archive/*` web endpoint in Gitea does not enforce token scope checks, unlike the `/raw/*`, `/media/*`, and attachment endpoints fixed in PR #37698. A personal access token scoped to any non-repository category (e.g., `read:issue` or `read:misc`) can be used to download full repository archives (zip/tar.gz) of private repositories the token owner can access, constituting a scope escalation.
Affected versions:
- <= 1.26.1
We recommend updating to: 1.26.2.
CVSS 9.1 · our assessment: act_now
Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-cr4g-f395-h25h
Details: https://vuln.today/cve/CVE-2026-20706
Verified by vuln.today against published advisories.
Affected versions
- – <= 1.26.1
Fixed in: 1.26.2
More advisories for code.gitea.io/gitea
- CVE-2026-55982 – OIDC userinfo scope bypass in Gitea (CVE-2026-55982)
- CVE-2026-58314 – Server-side request forgery in Gitea hostmatcher and OpenID sign-in (CVE-2026-58314)
- CVE-2026-58436 – Quadratic-time denial of service in Gitea Locale middleware (CVE-2026-58436)
- CVE-2026-58437 – Repository visibility manipulation via undocumented git push options in Gitea (CVE-2026-58437)
- CVE-2026-55987 – Account deactivation bypass via OAuth2 sign-in in Gitea (CVE-2026-55987)
- CVE-2026-54481 – Improper certificate validation in Gitea internal API HTTP client (CVE-2026-54481)
- CVE-2026-58443 – Authorization bypass in Gitea pull request update API endpoint (CVE-2026-58443)
- CVE-2026-56654 – Privilege escalation via Personal Access Token scope bypass in Gitea (CVE-2026-56654)