https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 01:45:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352792 EUVD-2026-352792 https://cve.radiocsirt.org/vuln/euvd-2026-352792 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58429 <p>Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints</p> <p>Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58429 https://cve.radiocsirt.org/vuln/ghsa-fq2p-5p22-8g6j <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such tokens are limited to public resources only.</p> <p>### Details The issue affects the following endpoints: GET /api/v1/user/orgs GET /api/v1/users/{username}/orgs/{org}/permissions</p> <p>The application correctly prevents a public-only token from directly accessing a private organization through: GET /api/v1/orgs/{org}</p> <p>However, that same token can still obtain private organization data through alternate code paths.</p> <p>The root cause is inconsistent enforcement of the public-only restriction. The middleware responsible for blocking non-public organization access depends on route context being populated with the target organization. That assumption does not hold for all affected routes.</p> <p>For GET /api/v1/user/orgs, the route does not apply checkTokenPublicOnly() at all.</p> <p>For GET /api/v1/users/{username}/orgs, the middleware is present, but it evaluates ctx.ContextUser, which represents the user named in the path, not the organization objects returned by the handler. Since ctx.Org.Organization is not populated for these responses, private organization results are not filtered.</p> <p>The organization listing logic then uses the effective relationship between the authenticated user and the target user to determine visibility. Whe…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such tokens are limited to public resources only.</p> <p>### Details The issue affects the following endpoints: GET /api/v1/user/orgs GET /api/v1/users/{username}/orgs/{org}/permissions</p> <p>The application correctly prevents a public-only token from directly accessing a private organization through: GET /api/v1/orgs/{org}</p> <p>However, that same token can still obtain private organization data through alternate code paths.</p> <p>The root cause is inconsistent enforcement of the public-only restriction. The middleware responsible for blocking non-public organization access depends on route context being populated with the target organization. That assumption does not hold for all affected routes.</p> <p>For GET /api/v1/user/orgs, the route does not apply checkTokenPublicOnly() at all.</p> <p>For GET /api/v1/users/{username}/orgs, the middleware is present, but it evaluates ctx.ContextUser, which represents the user named in the path, not the organization objects returned by the handler. Since ctx.Org.Organization is not populated for these responses, private organization results are not filtered.</p> <p>The organization listing logic then uses the effective relationship between the authenticated user and the target user to determine visibility. Whe…</p> https://cve.radiocsirt.org/vuln/ghsa-fq2p-5p22-8g6j https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304