Vulnerability · Published Nov 1, 2026 · Assigned by Gitea

CVE-2026-118395Gitea public-only token bypass in repository and organization creation

Unrated

In plain English

A security flaw in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS )–Not rated

Exploit odds (30 days)0.2%top 95.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POST /api/v1/orgs` and `POST /api/v1/repos/{owner}/{repo}/generate` still accepted such tokens. A holder of a public-only token with the needed write scopes could create private repositories in organizations where the token's owner may create repositories, create private organizations, and generate private repositories from templates. The token still could not read the private repositories it created.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – before 28.3.0

References

GitHub Security Advisory GHSA-x5v4-836g-f95x vendor-advisory
Fix: go-gitea/gitea pull request #39690 patch
Fix backport to release/v28: go-gitea/gitea pull request #39853 patch
Gitea 28.3.0 release announcement release-notes
go-gitea/gitea v28.3.0 release release-notes