{"id":"CVE-2026-118395","aliases":["EUVD-2026-114803","GHSA-x5v4-836g-f95x"],"status":"published","title":"Gitea public-only token bypass in repository and organization creation","description":"Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POST /api/v1/orgs` and `POST /api/v1/repos/{owner}/{repo}/generate` still accepted such tokens. A holder of a public-only token with the needed write scopes could create private repositories in organizations where the token's owner may create repositories, create private organizations, and generate private repositories from templates. The token still could not read the private repositories it created.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00277,"percentile":0.20342,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-11-01T09:48:51Z","modified":"2026-11-06T15:19:35Z","products":[{"vendor":"gitea","product":"gitea"}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-x5v4-836g-f95x","tags":["vendor-advisory","advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/39690","tags":["patch","fix"]},{"url":"https://github.com/go-gitea/gitea/pull/39853","tags":["patch","fix"]},{"url":"https://blog.gitea.com/release-of-28.3.0/","tags":["release-notes","advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","tags":["release-notes","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118395.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118395","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-118395","title":"Gitea public-only token bypass in repository and organization creation","description":"Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POST /api/v1/orgs` and `POST /api/v1/repos/{owner}/{repo}/generate` still accepted such tokens. A holder of a public-only token with the needed write scopes could create private repositories in organizations where the token's owner may create repositories, create private organizations, and generate private repositories from templates. The token still could not read the private repositories it created.","status":"published","published":"2026-11-01T09:48:51.036Z","modified":"2026-11-06T15:19:35.69Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-06T16:58:45.944646Z"}],"euvd":[{"id":"EUVD-2026-114803","description":"Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POST /api/v1/orgs` and `POST /api/v1/repos/{owner}/{repo}/generate` still accepted such tokens. A holder of a public-only token with the needed write scopes could create private repositories in organizations where the token's owner may create repositories, create private organizations, and generate private repositories from templates. The token still could not read the private repositories it created.","status":"published","published":"2026-11-01T09:48:51Z","modified":"2026-11-06T15:19:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-06T16:05:19.944528Z"}],"nvd":[{"id":"CVE-2026-118395","description":"Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POST /api/v1/orgs` and `POST /api/v1/repos/{owner}/{repo}/generate` still accepted such tokens. A holder of a public-only token with the needed write scopes could create private repositories in organizations where the token's owner may create repositories, create private organizations, and generate private repositories from templates. The token still could not read the private repositories it created.","status":"published","published":"2026-11-01T10:18:36.37Z","modified":"2026-11-06T16:17:51.063Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-06T18:00:55.423579Z"}],"osv":[{"id":"CVE-2026-118395","title":"Gitea public-only token bypass in repository and organization creation","description":"Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POST /api/v1/orgs` and `POST /api/v1/repos/{owner}/{repo}/generate` still accepted such tokens. A holder of a public-only token with the needed write scopes could create private repositories in organizations where the token's owner may create repositories, create private organizations, and generate private repositories from templates. The token still could not read the private repositories it created.","status":"published","published":"2026-11-01T09:48:51.036Z","modified":"2026-11-08T02:30:34.30790428Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-07T03:08:01.41647Z"}]}}