Public-Only Personal Access Tokens Scope Bypass in Gitea by Go Gitea
CVE-2026-58429

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea Open Source Git Server
Vendor
CVE Published:
13 August 2026

What is CVE-2026-58429?

A vulnerability in Gitea exposes Public-Only personal access tokens to unauthorized access, particularly affecting organization and permission endpoints. This flaw can be exploited to gain entry into segments of the system that should be restricted, potentially compromising sensitive permissions and organizational structures. Users are advised to upgrade to Gitea version 1.27.0 to mitigate this issue.

Affected Version(s)

Gitea Open Source Git Server 0 <= 1.26.4

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/releases/tag/v1.27.0
release-notes
https://blog.gitea.com/gitea-1.27.0-is-released/
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pcat2003
.