Description
Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.
Published: 2026-07-03
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint, permitting an authenticated user to download private repository archives even when the token does not have the appropriate download scope. This violation of scope controls leads to unauthorized disclosure of repository contents and is identified as CWE-284.

Affected Systems

The issue affects Gitea servers running any version up to and including 1.26.1; upgrading to 1.26.2 or later eliminates the vulnerability.

Risk and Exploitability

The vulnerability is remotely exploitable via the web API; the likely attack vector is a simple download request. An attacker only needs the archive download URL and a token, regardless of the token's scope. The EPSS score is < 1% and the flaw is not listed in CISA KEV. The CVSS score of 9.1 indicates high severity, reflecting the serious confidentiality impact of unauthorized access to repository archives.

Generated by OpenCVE AI on August 1, 2026 at 20:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Gitea to version 1.26.2 or newer, which restores correct scope enforcement for archive downloads.
  • If an immediate upgrade is not possible, issue repository archive download tokens with only the necessary scopes and revoke those that grant unnecessary archive‑download permissions.
  • Enable detailed logging of archive download requests and monitor for anomalous activity to detect abuse early.

Generated by OpenCVE AI on August 1, 2026 at 20:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-cr4g-f395-h25h Gitea: Token scope bypass on web archive download endpoint
History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Gitea
Gitea gitea Open Source Git Server
Vendors & Products Gitea
Gitea gitea Open Source Git Server

Mon, 06 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Description Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.
Title Gitea repository archive downloads bypass token scope checks
Weaknesses CWE-284
References

Subscriptions

Gitea Gitea Open Source Git Server
cve-icon MITRE

Status: PUBLISHED

Assigner: Gitea

Published:

Updated: 2026-07-06T18:34:55.061Z

Reserved: 2026-03-03T03:25:59.955Z

Link: CVE-2026-20706

cve-icon Vulnrichment

Updated: 2026-07-06T18:34:49.887Z

cve-icon NVD

Status : Deferred

Published: 2026-07-03T21:16:56.433

Modified: 2026-07-06T19:17:00.120

Link: CVE-2026-20706

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T20:30:12Z

Weaknesses