CVE-2026-119625
Deferred Deferred - Pending Action

Authentication Bypass via Scope Check in GitHub

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Gitea Limited

Description
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site administrator's token this applied to every account. Tokens are now accepted on this route only for feeds, which require `read:user` or `read:organization`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-119625

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119625 is a vulnerability in Gitea where personal access tokens sent via HTTP Basic Auth could access private user activity without proper scope checks. Tokens with unrelated scopes, like read:issue, could read private activity through RSS/Atom feeds, profile activity tabs, and private organization feeds. The issue occurred because the /{username} route did not verify token scopes correctly.

Detection Guidance

Check Gitea logs for unauthorized access to user RSS/Atom feeds or profile pages via HTTP Basic Auth. Inspect network traffic for requests to /{username}.rss, /{username}.atom, or /{username} with tokens lacking read:user or read:organization scopes.

Impact Analysis

This vulnerability could allow attackers with a scope-confined token to access private user activity, such as private issue titles, repository names, and organization feeds. For site administrators, tokens could expose data across all accounts. Private profile READMEs and repositories might also be accessible.

Compliance Impact

This vulnerability could lead to unauthorized access to private user activity, including private issue titles and repository names, violating data protection principles under GDPR and HIPAA. Exposure of such data without proper scope validation may result in non-compliance with regulations requiring strict access controls and user consent for personal data handling.

Mitigation Strategies

Upgrade Gitea to version 28.3.0 or later. Review and revoke any tokens that may have accessed private data. Ensure tokens sent via HTTP Basic Auth are restricted to required scopes only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...