Public-only personal access token scope enforcement in Gitea's REST API is inconsistently applied across two organization endpoints, allowing a token holder to enumerate private organization memberships and retrieve detailed permission data (ownership, admin status, write access, repository-creation capability) that the public-only restriction was explicitly designed to block. All Gitea versions prior to 1.27.0 are affected via GET /api/v1/user/orgs and GET /api/v1/users/{username}/orgs/{org}/permissions. Publicly available exploit code with full HTTP request/response traces is confirmed in the GHSA advisory; no CISA KEV listing exists, indicating no confirmed opportunistic mass exploitation at time of analysis.
Stored Cross-Site Scripting in WPForms (AI Form Builder for WordPress) through version 2.0.0.1 allows contributor-level authenticated attackers to inject persistent malicious scripts into WordPress pages via an unsanitized data-sitekey attribute in the OptinMonster integration handler. Exploitation is constrained by a high-complexity attack condition: the target site must have OptinMonster installed, configured with an active inline campaign emitting matching #om-{id} markup, since WPForms only processes the vulnerable attribute when OptinMonster fires its 'om.Campaign.load' event. No public exploit code or CISA KEV listing has been identified at time of analysis. The CVSS-assigned scope change (S:C) reflects that injected scripts execute in victims' browser sessions, crossing the security boundary from the server-side WordPress context.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite exposes an unauthenticated SMTP-based attack path allowing partial data manipulation and partial denial of service. Versions 12.2.3 through 12.2.15 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and Oracle rates this difficult to exploit (AC:H), placing the practical risk below the moderate CVSS 4.8 score for most organizations.
PeopleSoft Enterprise FIN eSettlements 9.2 exposes financial settlement data to unauthenticated network attackers via an HTTP-accessible authentication bypass, enabling limited unauthorized read access and write manipulation of settlement records. Carrying a CVSS 3.1 score of 4.8 with high attack complexity (AC:H), exploitation is not trivial and resists easy automation, but the financial nature of the affected data - electronic payments and settlement instructions - amplifies business risk well beyond the moderate numeric score. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept has been identified at the time of this analysis.
Partial authentication bypass in Oracle PeopleSoft Enterprise FIN Grants 9.2 exposes limited data read and write capabilities to unauthenticated network attackers over HTTP. Exploitation is rated difficult (AC:H), meaning the attacker must satisfy specific, unstated preconditions to succeed, constraining real-world risk despite the absence of authentication requirements. Impact is bounded: only a subset of Grants data is accessible for reading, and unauthorized inserts, updates, or deletes are limited to some accessible data - full database compromise is not implied. No public exploit code or active exploitation has been identified at time of analysis.
Oracle JDeveloper's ADF Faces component on versions 12.2.1.4.0 and 14.1.2.0.0 is susceptible to an authentication bypass exploitable over HTTP by unauthenticated network attackers. Successful exploitation yields partial unauthorized read and write/insert/delete access to data accessible within the JDeveloper context - confidentiality and integrity are both impacted at a limited scope. No public exploit has been identified at time of analysis, and the CVSS AC:H rating indicates meaningful technical barriers to exploitation, reducing the practical threat level despite the unauthenticated attack vector.
ACL bypass in kronosnet (versions ≤ 1.34) allows remote unauthenticated attackers to inject arbitrary data packets into cluster communication channels under a specific dual-condition deployment configuration. By spoofing a valid link ID in crafted network frames, an attacker circumvents the ACL subsystem entirely, potentially causing data corruption or service instabilities in clustering stacks shipped with Red Hat Enterprise Linux 8, 9, 10 and OpenShift Container Platform 4. No public exploit code and no active exploitation have been identified at time of analysis.
Oracle Production Scheduling versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes its Internal Operations component to exploitation by high-privileged remote attackers over HTTP. Successful exploitation yields partial unauthorized read and write access to accessible data alongside a partial denial of service condition. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS score of 4.7 (Medium) reflects the significant mitigation from the high-privilege prerequisite.
Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component, part of Oracle E-Business Suite) permits a highly privileged, locally authenticated attacker to bypass access controls and gain unauthorized read access to all Oracle Project Manufacturing data as well as limited write access. The CVSS vector (AV:L/AC:H/PR:H) confirms this is neither remotely exploitable nor accessible to low-privileged users, substantially constraining real-world impact despite the High confidentiality impact rating. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized data manipulation in Oracle Applications Framework (Oracle E-Business Suite) versions 12.2.8 through 12.2.15 exposes the Upload Attachments component to low-privileged network attackers who can read and modify a subset of accessible application data. Exploitation requires human interaction from a third party, consistent with a cross-site request forgery or social-engineering-assisted vector. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 3.1 base score of 4.6 (Medium) reflects limited impact scope with no availability impact.
Unauthorized data access and manipulation in Oracle Utilities Network Management System exposes the Security component across five supported release trains to network-based exploitation by low-privileged authenticated users. A successful attack requires human interaction from a victim other than the attacker, enabling partial confidentiality and integrity compromise - specifically unauthorized read access to a subset of NMS data and unauthorized insert, update, or delete operations. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis; the 'Authentication Bypass' tag in source intelligence appears to describe privilege escalation within the application rather than full authentication circumvention, given the CVSS PR:L metric.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged network attacker to cause a complete, repeatable crash or hang of the database service. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis; the CVSS 3.1 score of 4.4 (Medium) accurately reflects the high privilege requirement and elevated attack complexity that substantially constrain real-world risk.
Denial-of-service exposure in the MySQL Server and MySQL Cluster Replication component allows a high-privileged, network-connected attacker to crash or hang the database instance repeatedly. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update and ENISA EUVD-2026-46593. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, its presence in a broadly deployed database product warrants patch prioritization within normal maintenance cycles for affected installations.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Group Replication Plugin allows a high-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing exist at time of analysis; the high attack complexity and high privilege requirement substantially limit real-world exploitation reach.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause a complete hang or frequently repeatable crash of the database server. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the combination of high attack complexity and high privilege requirements substantially limits realistic exploitation risk.
Denial-of-service in MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-based attacker to cause a repeatable server hang or crash under difficult-to-reproduce conditions. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47 and the same 8.4/9.7 ranges, with Oracle issuing a fix via the July 2026 Critical Patch Update. No public exploit has been identified and this CVE is not listed in CISA KEV, but the broad version coverage across active MySQL release trains warrants timely patching for environments running MySQL replication.
Denial-of-service exploitation in Oracle MySQL Server and MySQL Cluster via the Clone Plugin allows a high-privileged, network-connected attacker to cause a complete hang or repeatedly repeatable crash of the database server. Affected version ranges span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed in Oracle's July 2026 Critical Patch Update. No public exploit or active exploitation has been identified; attack complexity is high and requires pre-existing high database privileges, significantly constraining real-world risk to insider or post-breach scenarios.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Clone Plugin allows a high-privileged, network-connected attacker to crash or hang the database server through a difficult-to-exploit attack path. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and Oracle disclosed this via its July 2026 Critical Patch Update; exploitation would result in complete availability loss for the targeted database instance.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Optimizer component allows a high-privileged, network-connected attacker to crash or hang the database server. Affected products span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; the high privilege and high complexity requirements materially constrain real-world risk.
Local file inclusion in Gitea's restore-repo CLI command allows operator-level attackers to exfiltrate arbitrary server-side files by embedding file:// URIs in release attachment DownloadURL fields within a crafted restore archive. Affected across all releases through v1.22.x (and unpatched master builds), with a fixed version available at 1.27.0. A working proof-of-concept was published by the reporting researchers; no active exploitation has been confirmed by CISA KEV, but successful exploitation yields direct access to high-value secrets including database credentials, SSH private keys, TLS certificates, and cloud provider tokens stored on the Gitea host.
Denial of service in Oracle MySQL Server and MySQL Cluster's replication component allows a high-privileged network attacker to cause a complete hang or repeatedly crash the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code and no confirmed active exploitation have been identified; the high privilege and high complexity requirements substantially constrain real-world risk to insider threats or compromised DBA-level accounts.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's DDL component allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash under difficult-to-reproduce conditions. Affected product lines span MySQL Server 8.4.x and 9.7.x and MySQL Cluster 8.0.x through 9.7.x, as confirmed in Oracle's July 2026 Critical Patch Update (EUVD-2026-46462). No public exploit or confirmed active exploitation has been identified at time of analysis.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) exposes an authentication bypass that permits low-privileged local users to read and modify CRM data beyond their authorized scope. The flaw requires an existing logon to the infrastructure hosting the application, constraining the attack surface to internal or compromised users rather than remote internet-based attackers. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.4 Medium rating reflects these limiting factors.
Local privilege abuse in Oracle GoldenGate's Libraries component allows low-privileged OS users on the GoldenGate host to read and modify a subset of GoldenGate-accessible data without proper authorization. Three major version branches are affected - 19.x, 21.x, and 23.x - covering a broad deployment window documented in Oracle's Critical Patch Update for July 2026. No public exploit or active exploitation has been identified at time of analysis; the moderate CVSS 4.4 score correctly reflects the local-only attack vector and constrained data impact.
Local integrity and availability compromise in Oracle Agile Engineering Data Management 6.2.1's Document Management component enables low-privileged local users to perform unauthorized data manipulation and trigger partial denial-of-service conditions. Oracle classifies this as 'easily exploitable' given low attack complexity, though the local infrastructure access requirement significantly constrains the realistic attacker pool. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.4 Medium score reflects the bounded impact ceiling - partial integrity and availability loss only, with no confidentiality exposure.
Integrity compromise in Oracle PeopleSoft Enterprise FIN Common Objects 9.2 allows a low-privileged local attacker to perform unauthorized creation, deletion, or modification of critical financial data when human interaction from another user is obtained. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 4.4, reflecting high attack complexity and a local-only attack vector. No public exploit code or active exploitation has been identified at time of analysis, and Oracle has disclosed the issue via its July 2026 Critical Patch Update.
Local access control weakness in Oracle Enterprise Manager Base Platform's Enterprise Config Management component allows low-privileged users with host logon rights to read a subset of OEM-accessible data and perform unauthorized inserts, updates, or deletes against accessible data records. Versions 13.5 and 24.1 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the local-only attack vector substantially constrains real-world exploitation to insider threats or previously compromised accounts.
Partial denial-of-service in Oracle Coherence 15.1.1.0.0 (Core component) allows a low-privileged attacker with TCP network access to intermittently degrade availability of the in-memory data grid. The CVSS 3.1 score of 4.3 reflects constrained impact - confidentiality and integrity are unaffected, and no complete service outage is possible. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; Oracle addressed this vulnerability in the July 2026 Critical Patch Update.
Oracle EDI Gateway versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes an information disclosure vulnerability allowing low-privileged network-authenticated attackers to read a subset of EDI transaction data without proper authorization. Tagged as an authentication bypass, the flaw is exploitable over HTTP with low attack complexity and no user interaction required, suggesting an access-control deficiency that permits privilege escalation within the application layer rather than a full bypass of authentication. No public exploit code and no active exploitation have been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Oracle EDI Gateway versions 12.2.3 through 12.2.15 exposes an information disclosure vulnerability via HTTP that enables low-privileged authenticated network attackers to read a subset of EDI transaction data without proper authorization. The vulnerability is tagged 'Authentication Bypass' in threat intelligence sources, yet the CVSS vector assigns PR:L, suggesting the bypass operates within an authenticated session - likely circumventing object-level authorization controls rather than bypassing session authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate despite the vendor's characterization of the flaw as 'easily exploitable.'
Unauthorized data disclosure in Oracle U.S. Federal Financials (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read a subset of sensitive financial data via HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate-severity information disclosure with no integrity or availability impact.
Unauthorized read access to Oracle GoldenGate data is possible through a flaw in the Admin Server Executable component, affecting three major release trains spanning versions 19.1.0.0.0 through 23.26.1. A low-privileged network attacker can exploit this Authentication Bypass issue over HTTP without user interaction to read a subset of GoldenGate-accessible data. No public exploit code and no CISA KEV listing have been identified at time of analysis; risk is elevated primarily for deployments exposing the Admin Server to untrusted networks.
Partial denial of service in Oracle Coherence's Core component allows a low-privileged, network-connected attacker to degrade availability across four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP with low attack complexity. The CVSS 3.1 vector confirms a straightforward network path requiring only a valid low-privilege account and no user interaction, with impact strictly bounded to partial availability loss - confidentiality and integrity are unaffected. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog.
Partial denial-of-service exposure in Oracle TimesTen In-Memory Database's Kubernetes Operator component (version 26.1.1.1.0) allows a low-privileged, network-authenticated attacker to degrade database availability via crafted HTTPS requests. The attack requires no user interaction and is rated easily exploitable by Oracle, though impact is limited to partial availability loss with no confidentiality or integrity effects. No public exploit code or CISA KEV listing has been identified at time of analysis.
FlexCity by Universal Software Inc. exposes an authentication rate-limiting failure (CWE-307) across versions 5.536.0 through 11052026, allowing low-privileged network attackers to submit unbounded authentication requests and cause excessive server-side resource allocation that degrades availability. The CVSS vector (AV:N/AC:L/PR:L/A:L) indicates a moderate, network-reachable flaw requiring existing credentials, though the vendor-applied 'Information Disclosure' tag conflicts with the C:N CVSS metric and raises the possibility of concurrent username enumeration not captured in the base score. Reported by TR-CERT; no public exploit code and no CISA KEV listing exist at time of analysis.
Privilege escalation in Eclipse hawkBit's Direct Device Integration (DDI) Controller allows any authenticated device to download firmware artifacts beyond those explicitly assigned to it, within the same tenant. The flaw - rooted in missing object-level authorization (CWE-284/CWE-862) - means a valid device credential is sufficient to access arbitrary firmware artifacts belonging to other devices in the same tenant, not just the device's own assigned updates. A secondary enumeration weakness in the software modules listing endpoint compounds the issue by enabling targeted discovery of available artifacts. No public exploit has been identified at time of analysis, and no CISA KEV listing is present.
Unauthorized data read in Oracle Coherence Core component affects all four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP, allowing a low-privileged network attacker to access a subset of cached data without proper authorization. The vendor-assigned 'Authentication Bypass' tag suggests the root cause is an authorization control deficiency in the HTTP-facing Core layer rather than a complete absence of authentication - low-privilege credentials appear sufficient to bypass higher-tier access controls. No public exploit or active exploitation has been identified at time of analysis; EPSS data was not provided in the input.
Unauthorized data exposure in Oracle Transportation Management 6.5.3 allows low-privileged remote attackers to read a subset of application data via HTTP, exploiting a flaw in the Authentication component. The vulnerability is tagged as an Authentication Bypass and is rated easily exploitable by Oracle, requiring only a low-privilege account and network access - no user interaction or complex conditions apply. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a constrained confidentiality-only impact.
Unauthorized data read in Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through the Kubernetes Operator component via HTTPS, allowing low-privileged authenticated network attackers to access a subset of database data they should not be authorized to read. The ENISA EUVD threat intelligence tags this as 'Authentication Bypass,' suggesting the Kubernetes Operator fails to enforce proper authorization controls after initial authentication, effectively allowing privilege overreach within an authenticated session. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Unauthorized data read in Oracle Utilities Network Management System's Mobile component allows low-privileged, network-adjacent attackers to access a subset of confidential NMS data via HTTP. Affected are five distinct version branches spanning 2.5.0.1.x through 25.12.0.0.x, as detailed in Oracle's July 2026 Critical Patch Update. Oracle classifies this as 'easily exploitable,' and the 'Authentication Bypass' tag suggests authorization control weaknesses beyond the low-privilege requirement implied by PR:L; no public exploit or CISA KEV listing exists at time of analysis.
Unauthorized data disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows a network-based, low-privileged attacker to read a subset of application data via the Xstore Mobile component over HTTP. Tagged as an Authentication Bypass, the flaw suggests a low-privileged authenticated session can exceed its authorized data access scope without elevated rights. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate, bounded confidentiality risk.
Missing capability checks in the Tutor LMS Elementor Addons WordPress plugin (Themeum) allow any authenticated WordPress user with Subscriber-level access or higher to activate the Tutor LMS and Elementor plugins without administrative authorization. Affected are all versions through 4.0.0, confirmed by Wordfence threat intelligence. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, and real-world impact is constrained by the requirement for a valid WordPress account.
Integrity compromise in Oracle Project Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes an authorization bypass in the Internal Operations component, allowing a low-privileged, network-authenticated attacker to perform unauthorized insert, update, or delete operations on accessible contract data via HTTP. The tag 'Authentication Bypass' from the EUVD entry indicates the flaw permits a legitimately authenticated but restricted user to exceed their intended data-access boundaries within the application. No public exploit or CISA KEV listing exists at time of analysis, limiting immediate mass-exploitation risk, though the low attack complexity and no required user interaction make the vulnerability straightforwardly exploitable once an attacker holds any valid application credential.
Unauthorized access to workflow execution outputs in Kibana 9.3.0-9.3.7 and 9.4.0-9.4.3 allows an authenticated low-privileged user to read sensitive data returned by workflow steps - including results from connected data sources they are not authorized to query - by directly calling the workflow output endpoint without the authorization the documented API requires. The flaw is classified as Missing Authorization (CWE-862) via Privilege Abuse (CAPEC-122), with impact limited to confidentiality within the user's accessible Kibana space. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Elastic has released patched versions 9.3.8 and 9.4.4.
Kibana's multi-tenancy Spaces model can be bypassed through an Insecure Direct Object Reference (IDOR) vulnerability, allowing authenticated users to read scheduled query results belonging to Spaces they are not authorized to access. Affected versions span Kibana 9.4.0 through 9.4.3, with the fix delivered in 9.4.4. The CVSS vector (PR:L, C:L) confirms the impact is limited to low-privilege authenticated access resulting in partial confidentiality loss - no integrity or availability impact is involved. No public exploit code exists and no CISA KEV listing has been identified at time of analysis.
RSS/Atom feed handlers in Gitea prior to v1.27.0 expose private repository content - commit metadata, release notes, tag names, and cross-repo activity streams - to holders of confined API tokens that are explicitly blocked from the same data via download routes. The bypass breaks the token-confinement guarantee introduced by PR #37698 for raw/archive/download handlers, which was never extended to the sibling feed endpoints despite those endpoints accepting identical token-based Basic auth. A working proof-of-concept is documented in the GHSA advisory verified against the official gitea/gitea:1.26.2 Docker image; the vulnerability is not confirmed in CISA KEV, and the primary realistic threat is a leaked or lower-trust token used in CI or third-party integrations circumventing its intended scope restrictions.
Partial denial of service in Oracle GoldenGate's Admin Server Executable component is reachable by unauthenticated attackers with access to the adjacent physical communication segment. Three major release trains are affected - 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.1 - making this broadly relevant across GoldenGate deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is bounded by the adjacent-network requirement.
Kibana's authorization layer fails to enforce ACLs correctly in certain code paths, allowing a lower-privileged authenticated user to cause data from restricted Elasticsearch sources to be processed under another user's elevated privileges - effectively a confused deputy attack resulting in unauthorized information disclosure. The CVSS 4.3 (Medium) rating reflects low confidentiality impact and the requirement for a valid Kibana account, but the real-world risk is material in multi-tenant or role-segregated deployments where data isolation is a compliance requirement. No active exploitation confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Token scope enforcement is bypassed on Gitea's repository home page handler (`repo.Home`), exposing private repository README, root file/directory tree, description, language statistics, license, and latest-release data to any authenticated PAT or OAuth2 token that lacks the `repository` scope or is marked `public-only`. This is the third in a series of related incomplete fixes - CVE-2026-20706 and CVE-2026-27761 patched sibling routes (archive download and RSS/Atom feeds) but the home route was overlooked, leaving it without the `CheckRepoScopedToken` guard applied to every neighboring handler. Publicly available exploit code exists in the form of a self-contained Docker-based proof-of-concept published in the vendor advisory; no active exploitation has been confirmed by CISA KEV.
OAuth token introspection in Gitea prior to v1.27.0 discloses token metadata - including active status, scope, username, and JWT registered claims - to any authenticated OAuth client regardless of whether that client is the token's intended audience, violating RFC 7662 section 4. Any registered OAuth application on the target instance can call `/login/oauth/introspect` with a token issued to a completely different client and receive a valid response. No public exploit is confirmed in CISA KEV, but a complete proof-of-concept reproduction script (`poc.sh`) is publicly attached to the GHSA advisory, making exploitation trivially reproducible by anyone with a registered OAuth client credential.