https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:05:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352871 EUVD-2026-352871 https://cve.radiocsirt.org/vuln/euvd-2026-352871 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58444 <p>Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents</p> <p>Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58444 https://cve.radiocsirt.org/vuln/ghsa-cp3q-vrj2-ghhh <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary A personal access token (PAT) or OAuth2 token that does **not** carry the `repository` scope or that is **public-only** is correctly rejected (HTTP 403) by the recently hardened web content routes (archive download, raw/media file download, and repository RSS/Atom feeds). However, the repository home page route `GET /{owner}/{repo}` (handler `repo.Home`) serves the **private** repository&#39;s rendered README, root file/directory tree, description, language statistics, license, and latest-release information to that same token.</p> <p>This is a token-scope enforcement bypass and private-repository content disclosure. It is the same source→sink pattern already fixed for neighbouring routes in:</p> <p>- **GHSA-cr4g-f395-h25h** (CVE-2026-20706) token scope bypass on web archive download - **GHSA-3pww-vcvm-3gmj** (CVE-2026-27761) token scope bypass on repository RSS/Atom feeds</p> <p>`repo.Home` is the remaining token-auth-enabled content route that was not given the guard.</p> <p>### Details / Root cause Web routes accept token authentication only when explicitly opted in with `webAuth.AllowBasic` / `webAuth.AllowOAuth2`. The repository home route carries `AllowBasic` (added so that `go get` can resolve private modules):</p> <p>```go // routers/web/web.go:1256 m.Get(&#34;/{username}/{reponame}&#34;, optSignIn, webAuth.AllowBasic, context.RepoAssignment, context.RepoRefByType(git.RefTypeBranch), repo.SetEditorconfigIfExists, repo.Home) ```</p> <p>When a PAT/OAuth2 token is supplied via HTTP Basic auth,…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary A personal access token (PAT) or OAuth2 token that does **not** carry the `repository` scope or that is **public-only** is correctly rejected (HTTP 403) by the recently hardened web content routes (archive download, raw/media file download, and repository RSS/Atom feeds). However, the repository home page route `GET /{owner}/{repo}` (handler `repo.Home`) serves the **private** repository&#39;s rendered README, root file/directory tree, description, language statistics, license, and latest-release information to that same token.</p> <p>This is a token-scope enforcement bypass and private-repository content disclosure. It is the same source→sink pattern already fixed for neighbouring routes in:</p> <p>- **GHSA-cr4g-f395-h25h** (CVE-2026-20706) token scope bypass on web archive download - **GHSA-3pww-vcvm-3gmj** (CVE-2026-27761) token scope bypass on repository RSS/Atom feeds</p> <p>`repo.Home` is the remaining token-auth-enabled content route that was not given the guard.</p> <p>### Details / Root cause Web routes accept token authentication only when explicitly opted in with `webAuth.AllowBasic` / `webAuth.AllowOAuth2`. The repository home route carries `AllowBasic` (added so that `go get` can resolve private modules):</p> <p>```go // routers/web/web.go:1256 m.Get(&#34;/{username}/{reponame}&#34;, optSignIn, webAuth.AllowBasic, context.RepoAssignment, context.RepoRefByType(git.RefTypeBranch), repo.SetEditorconfigIfExists, repo.Home) ```</p> <p>When a PAT/OAuth2 token is supplied via HTTP Basic auth,…</p> https://cve.radiocsirt.org/vuln/ghsa-cp3q-vrj2-ghhh https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304