CVE-2026-70407

Deferred Deferred - Pending Action

Gitea Organization Metadata Exposure via API Scope Bypass

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassing the intended restriction on the token's delegated access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70407

EUVD

EUVD-2026-101097

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-70407 is a token scope bypass vulnerability in Gitea affecting versions 1.27.2 and earlier. The GET /api/v1/orgs endpoint fails to enforce the required read:organization token scope, allowing tokens with only read:misc scope to list organization metadata. Site admin tokens may expose private or limited organizations, bypassing intended access restrictions.

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a version 1.27.2 or earlier. Use the command: curl -s http://your-gitea-server/api/v1/version | grep version. If the version is 1.27.2 or below, the system is vulnerable. Additionally, test the API endpoint with a token lacking read:organization scope but having read:misc scope. A successful response with organization metadata indicates the vulnerability.

Impact Analysis

This vulnerability allows unauthorized users with limited token scopes to access sensitive organization data, including private or limited organizations if the token belongs to a site admin. This poses a confidentiality risk by exposing restricted information.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to sensitive organization data. If an attacker exploits this flaw, they might retrieve private or limited organization metadata, which could include personal or confidential information. This unauthorized data exposure may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., Security Rule on access controls).

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. There are no workarounds, so patching is required. After upgrading, verify the fix by testing the API endpoint again with a token that lacks the read:organization scope.

Hi! I’m here to help you understand CVE-2026-70407. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70