Admin API Misconfiguration in Gitea by Go-Gitea
CVE-2026-117635

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
1 November 2026

What is CVE-2026-117635?

The admin API of Gitea was misconfigured, allowing public access tokens with admin privileges to exploit sensitive endpoints. This vulnerability enabled attackers to list private organizations, access user email addresses, create new organizations, obtain registration tokens, and generate new site administrator accounts, even after token revocation. This issue has been resolved by enforcing strict token policies on admin routes, preventing public-only tokens from accessing restricted API endpoints.

Affected Version(s)

Gitea 0 < 28.3.0

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/39690
patch
https://github.com/go-gitea/gitea/pull/39853
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/assakafpix
https://github.com/torjan0
https://github.com/silverwind
.