CVE-2026-27761CWE-863

Gitea repository feeds bypass API token scope enforcement

Medium · published July 3, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea repository feeds bypass API token scope enforcement
    cvelistv5