Repository Creation Flaw in Gitea's Organization Management
CVE-2026-70396
Currently unrated
What is CVE-2026-70396?
A vulnerability exists in Gitea's organization repository-creation API that allows the creation of organization-owned repositories without the necessary write:repository permission. This flaw results from the omission of the write:repository token scope, which is enforced in other repository-creation routes. Consequently, a personal access token or an OAuth application token lacking the required repository-write scope can still create repositories if the user has organization-level permissions, effectively bypassing the intended scope restrictions.
Affected Version(s)
Gitea 0 <= 1.27.2