CVE-2026-20706
published 2026-07-03CVE-2026-20706: Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.
PriorityP356critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.49%
40.3th percentile
Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
| code.gitea.io | gitea | >= 0 < 1.26.3 | 1.26.3 |
| code.gitea.io | gitea | >= 0 < 1.26.2 | 1.26.2 |
| gitea | gitea_open_source_git_server | <= 1.26.1 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
ghsa9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
ghsa·2026-07-21·CVSS 9.1
CVE-2026-58444 [CRITICAL] CWE-863 Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
### Summary
A personal access token (PAT) or OAuth2 token that does **not** carry the
`repository` scope or that is **public-only** is correctly rejected (HTTP 403)
by the recently hardened web content routes (archive download, raw/media file
download, and repository RSS/Atom feeds). However, the repository home page route
`GET /{owner}/{repo}` (handler `repo.Home`) serves the **private** repository's
rendered README, root file/directory tree, description, language statistics,
license, and latest-release information to that same token.
This is a token-scope enforcement bypass and private-repository content
disclosure. It is the same source→sink p
GHSA
Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
ghsa·2026-07-21·CVSS 9.1
CVE-2026-27761 [CRITICAL] CWE-863 Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
### Summary
A Gitea personal access token (PAT) restricted to a non-repository scope (e.g. `read:issue`) can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied (403) on `/raw`, `/media`, `/archive`, and the contents API. It leaks commit SHAs, full commit messages (which frequently contain secrets and internal context), and committer name + email.
### Details
Gitea enforces PAT scope on repository-content endpoints via `checkDownloadTokenScope()` (added in PR #37698, extended to the archive endpoint by the CVE-2026-20706 fix in 1.26.2). The RSS/Atom feed handlers
GHSA
Gitea: Token scope bypass on web archive download endpoint
ghsa·2026-06-16
CVE-2026-20706 [MEDIUM] CWE-863 Gitea: Token scope bypass on web archive download endpoint
Gitea: Token scope bypass on web archive download endpoint
## Summary
PR #37698 added checkDownloadTokenScope to /raw/*, /media/*, and attachment download web endpoints. The /archive/* endpoint (repo.Download in routers/web/repo/repo.go:372) was not included in the fix. This endpoint accepts OAuth2 tokens via webAuth.AllowOAuth2 (registered at routers/web/web.go:1649-1652) but does not call checkDownloadTokenScope or CheckRepoScopedToken.
A personal access token with any non-repository scope (e.g., read:issue or read:misc) can download full repository archives (zip/tar.gz) of private repositories the token owner has access to.
## Impact
Scope escalation: tokens scoped to non-repository categories can access full repository content through the archive download endpoint. Higher impact t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-03
Published