Skip to content
Heist/ feed
Back to feed
Medium

Gitea organization listing token scope bypass

Type: advisorySources: OSV

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassing the intended restriction on the token's delegated access.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-70407
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 18:35 UTC · Revision 1

Source evidence

Gitea organization listing token scope bypass

core-osv · Original source

Published 14 Oct 2026, 14:36 UTC

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassing the intended restriction on the token's delegated access.

osv:CVE-2026-70407
Complete source record
{
  "id": "6d31d27b13de7f23728138029c705188006b30a945773644d507bc5f15d7c91a",
  "url": "https://osv.dev/vulnerability/CVE-2026-70407",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Gitea organization listing token scope bypass",
    "summary": "Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassing the intended restriction on the token's delegated access.",
    "evidence": "osv:CVE-2026-70407",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-70407",
      "aliases": [
        "CVE-2026-70407",
        "GHSA-ww9q-7j5q-hrv5"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/go-gitea/gitea",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "146cc3eec57174711eac0e0a0c7b38670c6e3922"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.27.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "146cc3eec57174711eac0e0a0c7b38670c6e3922"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.27.3"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.27.2",
            "v1.27.1",
            "v1.27.0",
            "v1.27.0-rc0",
            "v1.28.0-dev",
            "v1.27.0-dev",
            "v1.26.0-dev",
            "v1.25.0-dev",
            "v1.24.0-dev",
            "v1.22.0-rc1",
            "v1.23.0-dev",
            "v1.22.0-rc0",
            "v1.21.0-rc0",
            "v1.22.0-dev",
            "v1.20.0-rc0",
            "v1.21.0-dev",
            "v1.20.0-dev",
            "v1.19.0-rc0",
            "v1.18.0-rc0",
            "v1.19.0-dev",
            "v1.18.0-dev",
            "v1.17.0-dev",
            "v1.16.0-rc1",
            "v1.15.0-rc1",
            "v1.16.0-dev",
            "v1.15.0-dev",
            "v1.14.0-dev",
            "v1.13.0-dev",
            "v1.12.0-dev",
            "v1.10.5",
            "v1.11.0-rc1",
            "v1.10.0-rc1",
            "v1.11.0-dev",
            "v1.9.0-rc1",
            "v1.10.0-dev",
            "v1.9.0-dev",
            "v1.7.0-dev",
            "v1.6.0-rc1",
            "v1.6.0-dev",
            "v1.5.0-rc1",
            "v1.5.0-dev",
            "v1.1.0",
            "v1.0.0",
            "v0.9.99"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70407.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:38.523548753Z",
      "provider": "osv",
      "references": [
        "https://blog.gitea.com/release-of-1.27.3/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70407.json",
        "https://github.com/go-gitea/gitea/releases/tag/v1.27.3",
        "https://github.com/go-gitea/gitea/security/advisories/GHSA-ww9q-7j5q-hrv5",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-70407",
        "https://github.com/go-gitea/gitea/pull/39041",
        "https://github.com/go-gitea/gitea/pull/39058"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-285"
        ],
        "cna_assigner": "Gitea",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70407.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-70407",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 505739,
  "published_at": "2026-10-14T14:36:59.167+00:00"
}