cyfenced.com →

[ CVE-2026-118395 · Published 1 Nov 2026 ]

Vulnerability in Gitea

Not scored yet EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POST /api/v1/orgs` and `POST /api/v1/repos/{owner}/{repo}/generate` still accepted such tokens. A holder of a public-only token with the needed write scopes could create private repositories in organizations where the token's owner may create repositories, create private organizations, and generate private repositories from templates. The token still could not read the private repositories it created.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • BSI CERT-BundWID-SEC-2026-4281

    Gitea: Multiple vulnerabilities Translated from German

    CVE-2026-118504CVE-2026-117677CVE-2026-119441+15 more CVEs

[ References ]References