CVE-2026-58429: Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such tokens are limited to public resources only.
References
- github.com/advisories/GHSA-fq2p-5p22-8g6j
- github.com/go-gitea/gitea/commit/a34eac5ef42ada433a7c7dafb98f15c13d7ad74e
- github.com/go-gitea/gitea/commit/f2a1271f164569264c378fad720b0c000fff3336
- github.com/go-gitea/gitea/pull/37118
- github.com/go-gitea/gitea/pull/37773
- github.com/go-gitea/gitea/releases/tag/v1.27.0
- github.com/go-gitea/gitea/security/advisories/GHSA-fq2p-5p22-8g6j
- nvd.nist.gov/vuln/detail/CVE-2026-58429
Code Behaviors & Features
Detect and mitigate CVE-2026-58429 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →