Gitea failed to reject personal access tokens designated as public‑only when these tokens were used to register an organization‑level Actions runner. The registration endpoint allowed the token to create a runner that then became capable of executing workflow jobs in all repositories of the organization, including private ones. An attacker who holds such a token with a write:organization scope, even though the token is limited to public resources, can therefore gain access to private repository contents, Actions workflow files, secrets, and variables, effectively escalating privileges within the organization.

The vulnerability affects the open‑source Gitea platform. No specific version range is listed in the available data, so all installations of Gitea that use the Actions runner registration endpoint are potentially impacted until a fix is applied.

The bug falls under CWE‑863 (Improper Authorization). Although no CVSS or EPSS score is provided, the ability to register a runner that can access private repositories represents a serious privilege escalation if an organization has Actions enabled for private projects. The risk is high for organizations holding private repositories and for users who possess public‑only tokens with write:organization access. No exploit is publicly reported in the KEV catalog, but the absence of a mitigation in the public space means the vulnerability could be actively abused by attackers who already possess the described token.