CVE-2026-27761: Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
A Gitea personal access token (PAT) restricted to a non-repository scope (e.g. read:issue) can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied (403) on /raw, /media, /archive, and the contents API. It leaks commit SHAs, full commit messages (which frequently contain secrets and internal context), and committer name + email.
References
- blog.gitea.com/release-of-1.26.3-and-1.26.4
- github.com/advisories/GHSA-3pww-vcvm-3gmj
- github.com/go-gitea/gitea/commit/9e84deb969aff5c1115c2984e41250f28c78451f
- github.com/go-gitea/gitea/pull/38147
- github.com/go-gitea/gitea/releases/tag/v1.26.3
- github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj
- nvd.nist.gov/vuln/detail/CVE-2026-27761
Code Behaviors & Features
Detect and mitigate CVE-2026-27761 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →