https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 11:35:06 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-12013 bdu:2026-12013 https://cve.radiocsirt.org/vuln/bdu:2026-12013 https://cve.radiocsirt.org/vuln/euvd-2026-333741 EUVD-2026-333741 https://cve.radiocsirt.org/vuln/euvd-2026-333741 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27761 <p>Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.</p> <p>Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27761 https://cve.radiocsirt.org/vuln/ghsa-3pww-vcvm-3gmj <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary A Gitea personal access token (PAT) restricted to a non-repository scope (e.g. `read:issue`) can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied (403) on `/raw`, `/media`, `/archive`, and the contents API. It leaks commit SHAs, full commit messages (which frequently contain secrets and internal context), and committer name + email.</p> <p>### Details Gitea enforces PAT scope on repository-content endpoints via `checkDownloadTokenScope()` (added in PR #37698, extended to the archive endpoint by the CVE-2026-20706 fix in 1.26.2). The RSS/Atom feed handlers were never included: they (a) opt into PAT auth via `webAuth.AllowBasic`, (b) serve private-repo content, but (c) never call `checkDownloadTokenScope()`.</p> <p>Affected handlers (all carry `AllowBasic`, none call the scope check): - `RenderBranchFeedRSS/Atom` - `routers/web/feed/render.go` (last 10 commits: SHA, title, full message, committer name + email) - `ShowFileFeed` - `routers/web/feed/file.go` (per-file commit history) - repo activity feed `/{owner}/{repo}.rss` / `.atom` - `TagsListFeedRSS/Atom`, `ReleasesFeedRSS/Atom` - `routers/web/repo/release.go`</p> <p>Root cause: `routers/web/web.go` registers the feed routes with `webAuth.AllowBasic` so a PAT authenticates, but the unit-permission middleware only checks the user&#39;s access, not the token&#39;s scope. `checkDownloadTokenScope` (`routers/web/repo/download.go` and th…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary A Gitea personal access token (PAT) restricted to a non-repository scope (e.g. `read:issue`) can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied (403) on `/raw`, `/media`, `/archive`, and the contents API. It leaks commit SHAs, full commit messages (which frequently contain secrets and internal context), and committer name + email.</p> <p>### Details Gitea enforces PAT scope on repository-content endpoints via `checkDownloadTokenScope()` (added in PR #37698, extended to the archive endpoint by the CVE-2026-20706 fix in 1.26.2). The RSS/Atom feed handlers were never included: they (a) opt into PAT auth via `webAuth.AllowBasic`, (b) serve private-repo content, but (c) never call `checkDownloadTokenScope()`.</p> <p>Affected handlers (all carry `AllowBasic`, none call the scope check): - `RenderBranchFeedRSS/Atom` - `routers/web/feed/render.go` (last 10 commits: SHA, title, full message, committer name + email) - `ShowFileFeed` - `routers/web/feed/file.go` (per-file commit history) - repo activity feed `/{owner}/{repo}.rss` / `.atom` - `TagsListFeedRSS/Atom`, `ReleasesFeedRSS/Atom` - `routers/web/repo/release.go`</p> <p>Root cause: `routers/web/web.go` registers the feed routes with `webAuth.AllowBasic` so a PAT authenticates, but the unit-permission middleware only checks the user&#39;s access, not the token&#39;s scope. `checkDownloadTokenScope` (`routers/web/repo/download.go` and th…</p> https://cve.radiocsirt.org/vuln/ghsa-3pww-vcvm-3gmj https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2027 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um erweiterte Berechtigungen zu erlangen, sich als Benutzer auszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um erweiterte Berechtigungen zu erlangen, sich als Benutzer auszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2027