Skip to content

CVE record · 1 source

CVE-2026-117635

The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens.

Vendor: Gitea
Product: Gitea
Weakness: CWE-284, CWE-1259
Exposure class: Developer platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

20

CVE NVD 4h ago

The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens.

The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email…

CVE-2026-117635 Gitea