Gitea Organization-List API Vulnerability Exposes Sensitive Metadata

CVE-2026-70407

What is CVE-2026-70407?

The organization-list API in Gitea is vulnerable due to improper enforcement of token scopes. Tokens that are intended for limited access, such as read:misc, can still retrieve sensitive organization metadata that should only be accessible to specific token scopes. This oversight allows users with a less privileged token—including site administrators—to access data about both limited and private organizations. Consequently, this vulnerability poses a risk of unauthorized information exposure, highlighting the need for stricter access controls in token management.

References