Token Repository Access Check Vulnerability in Gitea's Pull Request Handler
CVE-2026-70406

Currently unrated

Key Information:

Vendor: Gitea
Status: Gitea
Vendor: CVE Published:; 14 October 2026

What is CVE-2026-70406?

The vulnerability in Gitea's shared comparison helper allows a public-only token with read:repository scope to bypass repository access restrictions when updating pull requests. This enables the token to route comparisons or pull requests through a publicly accessible base repository, thus gaining unauthorized access to commit histories and diffs from a private head repository held by the token owner. As a result, sensitive data can be exposed without proper permission checks, posing a significant security risk.