Vulnerability · Published Oct 14, 2026 · Assigned by Gitea

CVE-2026-73126Gitea private workflow badge token scope bypass

Medium 4.3

In plain English

A medium-severity incorrect authorization in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 77.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository accessible to its owner. This discloses private workflow status beyond the token's intended delegated permissions.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – through 1.27.2

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory GHSA-r96c-jc75-rxv6 vendor-advisory
Gitea 1.27.3 release announcement release-notes
Fix: go-gitea/gitea pull request #39044 patch
Fix: go-gitea/gitea pull request #39058 patch
go-gitea/gitea v1.27.3 release release-notes