Vulnerability advisory

CVE-2026-27761

Gitea repository feeds bypass API token scope enforcement

Published Jul 3, 2026Updated Oct 28, 2026OSV record ↗

Also known as GHSA-3pww-vcvm-3gmjGO-2026-6031

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/go-gitea/gitea ↗
All commits before 4aa0d704f2c7d30351016b740bfc45247fd77efa	`4aa0d704f2c7d30351016b740bfc45247fd77efa`
Also listed as affected (43) `v1.26.2` `v1.26.1` `v1.26.0` `v1.26.0-rc0` `v1.27.0-dev` `v1.26.0-dev` `v1.25.0-dev` `v1.24.0-dev` `v1.22.0-rc1` `v1.23.0-dev` `v1.22.0-rc0` `v1.21.0-rc0` `v1.22.0-dev` `v1.20.0-rc0` `v1.21.0-dev` `v1.20.0-dev` `v1.19.0-rc0` `v1.18.0-rc0` `v1.19.0-dev` `v1.18.0-dev` `v1.17.0-dev` `v1.16.0-rc1` `v1.15.0-rc1` `v1.16.0-dev` `v1.15.0-dev` `v1.14.0-dev` `v1.13.0-dev` `v1.12.0-dev` `v1.10.5` `v1.11.0-rc1` `v1.10.0-rc1` `v1.11.0-dev` `v1.9.0-rc1` `v1.10.0-dev` `v1.9.0-dev` `v1.7.0-dev` `v1.6.0-rc1` `v1.6.0-dev` `v1.5.0-rc1` `v1.5.0-dev` `v1.1.0` `v1.0.0` `v0.9.99`

Description

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

CVE-2026-27761

Affected versions

Repository

Description

References