EUVD-2026-41634
GHSA-3pww-vcvm-3gmj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable feed endpoint requires only a low-privilege token (PR:L); scope bypass yields commit metadata only (C:L), with no integrity or availability impact.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.
AnalysisAI
Gitea's repository RSS and Atom feed endpoints fail to enforce API token scope checks, exposing private repository commit metadata to any holder of a valid but under-privileged API token. Versions up to and including 1.26.2 are affected; the flaw is classified as CWE-863 (Incorrect Authorization) with a CVSS score of 4.3. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available in v1.26.3 and v1.26.4.
Technical ContextAI
Gitea is a self-hosted, open source Git service written in Go, widely used by development teams as a lightweight alternative to GitHub Enterprise or GitLab. Repository RSS and Atom feeds are standard syndication endpoints that expose commit history in XML format. The root cause, CWE-863 (Incorrect Authorization), indicates that the authorization logic governing these feed endpoints does not validate whether the presenting API token carries the repository scope permission - a scope-specific check enforced elsewhere in the API surface. The affected CPE is cpe:2.3:a:gitea:gitea_open_source_git_server:*:*:*:*:*:*:*:*, covering all Gitea Open Source Git Server releases through 1.26.2. The fix was introduced via pull request https://github.com/go-gitea/gitea/pull/38147, which corrects the missing scope enforcement in the feed handler.
RemediationAI
Upgrade Gitea to version 1.26.3 or later (1.26.4 is also available per the vendor blog); both releases contain the scope enforcement fix introduced in https://github.com/go-gitea/gitea/pull/38147. Release artifacts and changelogs are available at https://github.com/go-gitea/gitea/releases/tag/v1.26.3 and https://blog.gitea.com/release-of-1.26.3-and-1.26.4/. For instances where immediate upgrade is not possible, a compensating control is to block or restrict access to the feed endpoints (typically /[user]/[repo].rss and /[user]/[repo].atom) via a reverse proxy or WAF rule - this prevents the bypass entirely but also disables legitimate RSS/Atom feed consumption. Administrators should also audit all active API tokens to ensure minimum-scope issuance, reducing the utility of any token that might be used to exploit this flaw.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today