CVE-2026-20706CWE-284

Gitea repository archive downloads bypass token scope checks

Critical · published July 3, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
46.2
In the wild
Unconfirmed
What it is

Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00565 · 46.2th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea repository archive downloads bypass token scope checks
    cvelistv5