Improper Token Scope Validation in Gitea Affects User Privacy

CVE-2026-119625

What is CVE-2026-119625?

A significant vulnerability in Gitea was identified where personal access tokens were accepted over HTTP Basic authentication without proper scope validation. This oversight allowed tokens restricted to unrelated scopes, such as ‘read:issue’, to access the owner's private activities through user feeds and other sections of the platform. Even public-only tokens could unintentionally expose private repositories and organization data, violating user privacy. This issue has been addressed by enforcing stricter token scope requirements, ensuring that only tokens with the necessary permissions, i.e., ‘read:user’ or ‘read:organization’, can access sensitive user feeds.

References