CVE-2026-70396

Deferred Deferred - Pending Action

Gitea Organization Repository Creation Token Scope Bypass

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70396

EUVD

EUVD-2026-101093

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows a personal access token or OAuth token with only write:organization scope to create organization-owned repositories, bypassing the write:repository scope requirement enforced by other repository creation routes. The issue occurs because the organization repository-creation API does not validate the repository scope, enabling unauthorized repository creation if the user has organization permissions.

Detection Guidance

Check Gitea server version with: curl -s http://your-gitea-server/api/v1/version | grep version. If version is below 1.27.3, the system is vulnerable. Review API logs for unauthorized repository creation attempts in organization contexts.

Impact Analysis

An attacker could exploit this to create unauthorized repositories in an organization, occupying namespace and potentially bypassing storage quotas. This could lead to resource exhaustion or unauthorized project setup. However, it does not allow reading private repository contents or bypassing user organization membership.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it relates to unauthorized repository creation rather than data protection or privacy controls. The issue involves token authorization bypass in Gitea's API, which could lead to unauthorized repository setup but does not involve access to sensitive personal or health data.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. Review and revoke any personal access tokens or OAuth applications that have write:organization scope without write:repository. Audit organization repository creation logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-70396. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70