All vulnerabilities
CVE-2026-70396GHSA-hxhc-246f-rvqc

Gitea organization repository creation token scope bypass

Gitea Gitea
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.40%Chance of exploitation activity in the next 30 days, higher than 33% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.27.3Fixed versionGitHub
Published14 Oct 2026Updated 18 Oct 2026CVE List

What fixes it

  • 1.27.3code.gitea.io/gitea, otherGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions.

Text from CVE List

Affected versions 2

  • Giteaaffected: all versions through 1.27.2CVE List
  • code.gitea.io/gitea, other<= 1.27.2GitHub

References 5