CVE-2026-70406

Deferred Deferred - Pending Action

Gitea Repository Access Bypass via Shared Comparison Helper

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head repository accessible to the token owner. This bypasses the token's public-only restriction; it does not remove the account's underlying repository permission checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70406

EUVD

EUVD-2026-101096

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows a public-only token with read:repository scope to bypass repository-access checks when comparing repositories or creating pull requests. It routes requests through a public base repository to access commit history and diffs from a private head repository owned by the token holder. The token's public-only restriction is bypassed, but underlying account permissions still apply.

Detection Guidance

Check Gitea version with 'gitea --version' or via admin panel. If version is below 1.27.3, the system is vulnerable. Review API logs for unusual compare or pull request operations involving private repositories.

Impact Analysis

If you use Gitea with public-only tokens, an attacker could exploit this to access private repository data through comparison or pull request endpoints. This could lead to unauthorized exposure of sensitive code, commit history, or changes in private repositories you have access to.

Compliance Impact

This vulnerability could lead to unauthorized access to private repositories, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, depending on the data stored in the repositories.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. Review and restrict token scopes, ensuring public-only tokens are not used for private repository access. Monitor API endpoints for compare and pull request operations.

Hi! I’m here to help you understand CVE-2026-70406. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70