A public‑only token can be used to call the /api/v1/user endpoint for a user’s own account. Because the token’s permissions are public, the endpoint does not enforce the normal private‑resource restrictions, allowing an attacker to obtain or modify data that should be restricted to the authenticated user. This weakness is a privilege‑management error, identified as CWE‑863, and can expose sensitive user profile information and potentially other private data managed through that endpoint.

The issue affects the Gitea Open Source Git Server. The affected versions include all releases prior to the 1.26.2 update, which resolves the token‑scope filtering bug, as inferred from the referenced release notes. No detailed sub‑version list is provided, so any deployment of Gitea before 1.26.2 is potentially vulnerable.

The vulnerability is exploitable through the documented REST API. It carries a CVSS score of 8.1. An attacker only needs a public‑only token that they can acquire or receive, and the token can then read or update the bearer’s private resources. Because no EPSS score is available and the issue is not listed in CISA KEV, the public exploitation probability is uncertain, but the potential impact on confidentiality makes it a high‑risk finding. The attack path requires API access and valid authentication credentials, so the attack surface is limited to systems where an attacker can obtain or forge a public‑only token.