Improper Token Validation in Gitea Repository Migration API
CVE-2026-70400

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-70400?

The repository migration API in Gitea improperly processes public-only tokens, enabling them to create private repositories under certain conditions. Although standard repository creation rejects such tokens, the migration path lacks this restriction, posing a security risk for unauthorized manipulation of repository settings.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39007
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/rexpository
https://github.com/bircni
.