Gitea EUVD-2026-58158

Exploitation requires three concurrent conditions: (1) the attacker must be an authenticated Gitea user who is a member of at least one team within a private organization, (2) that user must possess a public-only organization-scoped API token (a deliberate security-scoping feature available in Gitea's token management UI), and (3) the targeted organization must contain private repositories or private activity entries. The bypass occurs specifically because the team route group does not load ctx.Org.Organization, causing the checkTokenPublicOnly middleware to silently skip the visibility check. Exploitation is limited to information disclosure of repository metadata and activity feed data - repository content (code, commits, files) is not directly exposed by these endpoints. No network-level preconditions beyond standard HTTPS API access to the Gitea instance.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N scores 4.3 (Medium), which accurately reflects the bounded scope of impact: only metadata (repository names, activity feed entries) is disclosed, not repository content or credentials. PR:L confirms exploitation requires an authenticated session - the attacker must be a legitimate team member who possesses or obtains a public-only token. AC:L indicates no special timing or race condition is needed. No EPSS score is available in the provided data; given the authenticated prerequisite and metadata-only disclosure, real-world exploitation probability is likely low to moderate. No CISA KEV listing exists, but a working PoC has been publicly verified against the latest release (1.26.2), which meaningfully raises exploitability compared to theoretical vulnerabilities. The principal risk scenario is an insider or compromised account using a deliberately scoped (public-only) token to enumerate private organizational structure - useful for reconnaissance but not for direct code theft. No conflicting signals between CVSS vector and description; both consistently indicate network-accessible, low-complexity, authenticated read-only access.

A developer or CI/CD service account holds a public-only organization-scoped Gitea API token intended to limit access to public resources. By sending authenticated GET requests to /api/v1/teams/{teamid}/repos or the team activity feed endpoint with this token, the attacker retrieves private repository names and organizational activity entries that should be hidden. A working PoC has been publicly verified against Gitea 1.26.2, meaning exploitation requires only a valid public-only token and knowledge of a team ID reachable by that token.