Vulnerability advisory
GO-2026-6036
Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) in gitea.dev
Also known as CVE-2026-50105GHSA-6cqf-375w-639g
Severity
Severity not reported.
Affected versions
gitea.dev Go
| Affected | Fixed in |
|---|---|
| All versions before 1.27.0 | 1.27.0 |
Description
Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) in gitea.dev