Auth bypass in Gitea Open Source Git Server
CVE-2026-56443
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
Vulnerability class: Broken Access Control
Affected products
- Gitea Open Source Git Server — versions 0
Weakness classification (CWE)
References
- 88ee5874-cf24-4952-aea0-31affedb7ff2 (vendor-advisory)
- 88ee5874-cf24-4952-aea0-31affedb7ff2 (release-notes)
- 88ee5874-cf24-4952-aea0-31affedb7ff2 (release-notes)