Access Token Flaw in Gitea Affects Repository Control

CVE-2026-118395

What is CVE-2026-118395?

A flaw in Gitea 1.27.3 permits public access tokens restricted to public resources to create private repositories within organizations. Though the personal access tokens ('public-only') initially prevented repository creation via certain API endpoints, they still allowed creation through others. This loophole enables users with public-only tokens to generate private repositories, organizations, and even transfer repository templates, all of which can lead to unintended privacy and security implications. Affected users should be aware of these limitations and consider updating to secure versions of Gitea.

References