CVE-2026-70396

MediumCVSS 5.4/10Last modified Oct 18, 2026

Description

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Gitea	Gitea	<= 1.27.2

References

Timeline

Published: Oct 14, 2026
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-703989.6A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authen CVE-2026-703998.7Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to ca CVE-2026-70407.5Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify CVE-2026-704005.4Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token CVE-2026-704025.8Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permiss CVE-2026-704039.3XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected de CVE-2026-704056.3Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by send CVE-2026-704066.5Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:rep CVE-2026-704074.3Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, ca CVE-2026-704088.7An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileg CVE-2026-704096.3Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrad CVE-2026-70413.7A vulnerability was detected in 666ghj MiroFish up to 0.1.2. The impacted element is an unknown function of the file /console of the compone