Token Authentication Flaw in Gitea's Actions Workflow Affecting Repository Privacy
CVE-2026-73126
Currently unrated
What is CVE-2026-73126?
The Gitea platform contains a vulnerability in its Actions workflow status badge endpoint, which fails to properly enforce the repository-read scope along with the public-only restriction. As a result, tokens that do not possess 'read:repository' permissions, or are limited to public repositories, are capable of accessing the latest workflow status of private repositories. This compromises the privacy of workflow status, exposing sensitive information beyond what the token was expressly authorized to retrieve.
Affected Version(s)
Gitea 0 <= 1.27.2