Description
Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.
Published: 2026-07-03
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Gitea releases up to and including version 1.26.1 permit repository archive downloads that bypass token scope checks on the web archive download endpoint, enabling an authenticated user to retrieve the contents of private archives even when the token lacks the proper download scope. This flaw compromises confidentiality by exposing data that should be protected by scope restrictions (CWE-284).

Affected Systems

The issue affects Gitea servers running any version up to and including 1.26.1; upgrading to 1.26.2 or later eliminates the vulnerability.

Risk and Exploitability

The vulnerability is remotely exploitable via the web API; the likely attack download. An attacker only needs the archive download URL and a token, regardless of the token's scope. The EPSS score is < 1% and the flaw is not listed in CISA KEV. The CVSS score of 9.1 indicates high severity, reflecting the serious confidentiality impact of unauthorized access to repository archives.

Generated by OpenCVE AI on July 23, 2026 at 16:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Gitea to version 1.26.2 or newer, which restores archive downloads.
  • If an immediate upgrade is not possible, issue repository archive download tokens with only the necessary scopes and revoke those that grant unnecessary archive‑download permissions.
  • Enable detailed logging of archive download requests and monitor for anomalous activity to detect abuse early.

Generated by OpenCVE AI on July 23, 2026 at 16:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-cr4g-f395-h25h Gitea: Token scope bypass on web archive download endpoint
History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Gitea
Gitea gitea Open Source Git Server
Vendors & Products Gitea
Gitea gitea Open Source Git Server

Mon, 06 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Description Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.
Title Gitea repository archive downloads bypass token scope checks
Weaknesses CWE-284
References

Subscriptions

Gitea Gitea Open Source Git Server
cve-icon MITRE

Status: PUBLISHED

Assigner: Gitea

Published:

Updated: 2026-07-06T18:34:55.061Z

Reserved: 2026-03-03T03:25:59.955Z

Link: CVE-2026-20706

cve-icon Vulnrichment

Updated: 2026-07-06T18:34:49.887Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-23T16:30:09Z

Weaknesses