CVE-2026-117635
Deferred Deferred - Pending Action

Authentication Bypass via Public-Only Admin Tokens

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Gitea Limited

Description
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-117635

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1259 The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Gitea versions up to 28.2.0. Public-only personal access tokens, which should only access public resources, can bypass restrictions on the admin API. This allows attackers with such tokens to list private organizations, view all user emails, create organizations, generate runner tokens, and even create new site admin accounts.

Detection Guidance

Check Gitea logs for unauthorized access to /api/v1/admin routes. Review token permissions for public-only tokens with admin scopes. Verify if private organizations or user emails were accessed without proper authorization.

Impact Analysis

If you are a Gitea administrator, an attacker with a public-only token could gain full administrative access, create new admins, or access sensitive user data like emails. Regular users with public-only tokens cannot exploit this issue.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Exposure of user emails and private organizations may result in compliance breaches.

Mitigation Strategies

Upgrade Gitea to version 28.3.0 or later. Revoke all public-only tokens with admin scopes. Audit admin API access logs for suspicious activity. Ensure proper token restrictions are enforced on all route groups.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117635. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...