Public-Only Personal Access Tokens Scope Bypass in Gitea by Go Gitea
CVE-2026-58429

4.9MEDIUM

Key Information:

Vendor

Gitea

Status
Gitea Open Source Git Server
Vendor
CVE Published:
13 August 2026

What is CVE-2026-58429?

A vulnerability in Gitea exposes Public-Only personal access tokens to unauthorized access, particularly affecting organization and permission endpoints. This flaw can be exploited to gain entry into segments of the system that should be restricted, potentially compromising sensitive permissions and organizational structures. Users are advised to upgrade to Gitea version 1.27.0 to mitigate this issue.

Affected Version(s)

Gitea Open Source Git Server 0 <= 1.26.4

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/releases/tag/v1.27.0
release-notes
https://blog.gitea.com/gitea-1.27.0-is-released/
release-notes

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pcat2003
.