Description
Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.
Published: 2026-07-03
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Gitea releases up to 1.26.2 allow the RSS and Atom feed endpoints to bypass API access token scope checks, enabling any API token that does not have the required repository scope to retrieve private commit data. This flaw, identified as CWE‑863, results in accidental leakage of confidential information from private repositories.

Affected Systems

Gitea Open Source Git Server, versions 1.26.2 and earlier.

Risk and Exploitability

The moderate CVSS score of 4.3 and a very low EPSS score of <1% suggest a moderate severity but limited likelihood of exploitation. Based on the description, it is inferred that the attack vector is remote network access: an adversary who can obtain a valid API token without repository scope can request the feed URLs from any reachable location, thereby exposing private commit history. The flaw is not listed in CISA KEV, indicating no known widespread exploitation at this time.

Generated by OpenCVE AI on July 24, 2026 at 10:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Gitea to version 1.26.3 or later so that token scope enforcement is restored for feed endpoints.
  • Revoke or restrict any API tokens that do the necessary repository scope whenever they are not required for legitimate use.
  • If the RSS and Atom feed features are not needed, disable them or apply stricter authenticationa configuration to prevent unauthorized access.

Generated by OpenCVE AI on July 24, 2026 at 10:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-3pww-vcvm-3gmj Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
History

Tue, 07 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Gitea
Gitea gitea Open Source Git Server
Vendors & Products Gitea
Gitea gitea Open Source Git Server

Fri, 03 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Description Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.
Title Gitea repository feeds bypass API token scope enforcement
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Gitea Gitea Open Source Git Server
cve-icon MITRE

Status: PUBLISHED

Assigner: Gitea

Published:

Updated: 2026-07-07T16:58:51.949Z

Reserved: 2026-03-03T03:26:00.375Z

Link: CVE-2026-27761

cve-icon Vulnrichment

Updated: 2026-07-07T14:38:04.145Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T10:45:03Z

Weaknesses