CVE-2026-70400

Deferred Deferred - Pending Action

Gitea Repository Migration API Private Repository Creation via Public Token

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that user has the necessary permissions. The ordinary private repository-creation route rejects the same token, but the migration path omits that restriction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70400

EUVD

EUVD-2026-101094

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows a public-only token to create private repositories during a repository migration. Normally, public-only tokens are restricted from creating private repositories, but the migration API bypasses this check. This enables unauthorized creation of private repositories and migration tasks under the user's account or organizations they manage.

Detection Guidance

Check Gitea server logs for unauthorized repository migration attempts using public-only tokens. Look for API calls to /api/v1/repos/migrate with private repository creation flags. Verify token scopes in use by inspecting token metadata and access logs for migration endpoints.

Impact Analysis

This vulnerability could allow an attacker with a public-only token to create private repositories and migration tasks, consuming namespace and quota resources. While it does not allow reading existing private repository contents, it still poses a moderate security risk by enabling unauthorized resource creation.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized creation of private repositories through public-only tokens. This may lead to improper data segregation or unauthorized storage of sensitive information, violating data protection requirements for controlled environments.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. Review all active tokens and revoke any public-only tokens with repository creation privileges. Monitor for unauthorized private repository creations or migrations in audit logs.

Hi! I’m here to help you understand CVE-2026-70400. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70