CVE-2026-70400

MediumCVSS 5.4/10Last modified Oct 14, 2026

Description

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that user has the necessary permissions. The ordinary private repository-creation route rejects the same token, but the migration path omits that restriction.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Gitea	Gitea	<= 1.27.2

References

Timeline

Published: Oct 14, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-704025.8Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permiss CVE-2026-704039.3XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected de CVE-2026-704056.3Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by send CVE-2026-704066.5Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:rep CVE-2026-704074.3Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, ca CVE-2026-704088.7An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileg CVE-2026-704096.3Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrad CVE-2026-70413.7A vulnerability was detected in 666ghj MiroFish up to 0.1.2. The impacted element is an unknown function of the file /console of the compone CVE-2026-704108.8Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantia CVE-2026-704116.5Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the CVE-2026-704123.5Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Eras CVE-2026-704135.6Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker