CVE-2026-56443
Received Received - Intake

Token Scope Bypass in GitHub Limited-Visibility Repos

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-56443
EUVD
EUVD-2026-58142

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go-gitea gitea *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-56443 is a vulnerability in Gitea where a public-only Personal Access Token (PAT) can bypass access restrictions for repositories and packages owned by users with Limited visibility. The issue occurs because checks for Repository and Package categories incorrectly use IsPrivate() instead of IsPublic(), allowing unauthorized access.

Detection Guidance

To detect this vulnerability, review Gitea logs for unauthorized access attempts to repositories or packages with Limited visibility using public-only PATs. Check API endpoints like /api/v1/packages, repository access, and LFS routes for suspicious activity. No specific commands are provided in the context.

Impact Analysis

An attacker with a public-only PAT could access sensitive content in Limited-visibility repositories and packages. This includes private data, files, or packages that should be restricted. The attack requires low complexity and no user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) by exposing private user content. Compliance risks include data breaches and failure to maintain required access controls.

Mitigation Strategies

Immediately update Gitea to the latest patched version to address the incorrect authorization checks. Review and restrict access to repositories and packages with Limited visibility. Monitor for any signs of unauthorized access or data exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56443. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart