{"id":"CVE-2026-27761","revision":null,"records":[{"revision":"079bf2c16c11481bb91d8fd987a92e52","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-27761","aliases":[],"title":"Gitea repository feeds bypass API token scope enforcement","description":"Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.","state":0,"publishedAt":"2026-07-03T20:19:36.576+00:00","modifiedAt":"2026-07-07T16:58:51.949+00:00","affected":[{"ecosystem":"Vendor product","name":"Gitea Open Source Git Server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Gitea\",\n                    \"product\": \"Gitea Open Source Git Server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"1.26.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj","https://github.com/go-gitea/gitea/pull/38147","https://github.com/go-gitea/gitea/releases/tag/v1.26.3","https://blog.gitea.com/release-of-1.26.3-and-1.26.4/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-27761","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-27761","identifiers":["CVE-2026-27761"]},"retained":false,"historicalAffected":[]},{"revision":"d29311d97ff44fbcb3b31d8b807b44dc","observedAt":"2026-11-07T13:21:49.663+00:00","statement":{"source":"euvd","id":"EUVD-2026-41634","aliases":["CVE-2026-27761","GHSA-3pww-vcvm-3gmj"],"title":"Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.","description":"Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":null}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj","https://github.com/go-gitea/gitea/pull/38147","https://github.com/go-gitea/gitea/releases/tag/v1.26.3","https://blog.gitea.com/release-of-1.26.3-and-1.26.4/"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41634","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 3, 2026, 8:19:36 PM","dateUpdated":"Jul 7, 2026, 4:58:51 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-41634","identifiers":["EUVD-2026-41634","CVE-2026-27761","GHSA-3pww-vcvm-3gmj"]},"retained":false,"historicalAffected":[]},{"revision":"9eb1783cbef94a81a50b3c33884da606","observedAt":"2026-10-27T07:23:32.255+00:00","statement":{"source":"nvd","id":"CVE-2026-27761","aliases":[],"title":"Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.","description":"Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.","state":0,"publishedAt":"2026-07-03T21:16:58.937+00:00","modifiedAt":"2026-10-25T15:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · 88ee5874-cf24-4952-aea0-31affedb7ff2 · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","https://github.com/go-gitea/gitea/pull/38147","https://github.com/go-gitea/gitea/releases/tag/v1.26.3","https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-27761","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-863"],"productCriteria":[],"sourceDates":{"published":"2026-07-03T21:16:58.937","lastModified":"2026-10-25T15:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-27761","identifiers":["CVE-2026-27761"]},"retained":false,"historicalAffected":[]},{"revision":"9226ecb8d44248e991dc6887e17d550f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-3pww-vcvm-3gmj","aliases":["CVE-2026-27761","GO-2026-6031"],"title":"Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data","description":"### Summary\nA Gitea personal access token (PAT) restricted to a non-repository scope (e.g. `read:issue`) can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied (403) on `/raw`, `/media`, `/archive`, and the contents API. It leaks commit SHAs, full commit messages (which frequently contain secrets and internal context), and committer name + email.\n\n### Details\nGitea enforces PAT scope on repository-content endpoints via `checkDownloadTokenScope()` (added in PR #37698, extended to the archive endpoint by the CVE-2026-20706 fix in 1.26.2). The RSS/Atom feed handlers were never included: they (a) opt into PAT auth via `webAuth.AllowBasic`, (b) serve private-repo content, but (c) never call `checkDownloadTokenScope()`.\n\nAffected handlers (all carry `AllowBasic`, none call the scope check):\n- `RenderBranchFeedRSS/Atom` - `routers/web/feed/render.go` (last 10 commits: SHA, title, full message, committer name + email)\n- `ShowFileFeed` - `routers/web/feed/file.go` (per-file commit history)\n- repo activity feed `/{owner}/{repo}.rss` / `.atom`\n- `TagsListFeedRSS/Atom`, `ReleasesFeedRSS/Atom` - `routers/web/repo/release.go`\n\nRoot cause: `routers/web/web.go` registers the feed routes with `webAuth.AllowBasic` so a PAT authenticates, but the unit-permission middleware only checks the user's access, not the token's scope. `checkDownloadTokenScope` (`routers/web/repo/download.go` and the archive `Download` in `repo.go`) exists to close exactly that gap and is absent from the feed handlers. Same class as the recently fixed download/archive bypasses (GHSA-cr4g-f395-h25h / CVE-2026-20706); the feeds are the surface those fixes missed.\n\n### PoC\nTested on `gitea/gitea:1.26.2-rootless`, confirmed present at `main` HEAD (9608cc2, 2026-06-13).\n1. User `carol` owns private repo `carol/priv` with a commit (message: \"add confidential secret\").\n2. Create a PAT scoped to issues only, no repository scope:\n   `curl -u carol:PASS -X POST $HOST/api/v1/users/carol/tokens -d '{\"name\":\"t\",\"scopes\":[\"read:issue\"]}'`\n3. Scope-enforcing sibling correctly denies it:\n   `curl -u carol:$TOK $HOST/carol/priv/raw/branch/main/secret.txt`  ->  403\n4. The feed leaks private data with the same token:\n   `curl -u carol:$TOK $HOST/carol/priv/rss/branch/main`  ->  200, returns\n   `<description>add confidential secret ... this commit message itself is sensitive</description>`\n\n| Auth (same read:issue token) | /raw/branch/main/secret.txt | /rss/branch/main |\n|---|---|---|\n| anonymous | - | 404 (private repo hidden) |\n| invalid token | - | 401 |\n| read:issue token (no repo scope) | 403 (scope enforced) | 200 + private commit data |\n| full-scope token | 200 | 200 (legitimate) |\n\n### Impact\nPATs are routinely issued narrowly and handed to third-party bots, CI jobs, or chat integrations that are meant to have no code access. This bypass lets such a token exfiltrate private-repository commit history (messages often hold secrets, ticket refs, internal context) and committer emails for every repository the owner can read. Confidentiality only; no integrity or availability impact. Preconditions: a valid PAT of any non-repository scope owned by a user with read access to the target private repo, and feeds enabled (`Other.EnableFeed`, default ON).\n\nSuggested fix: call `checkDownloadTokenScope(ctx)` at the start of each feed handler (mirroring `download.go`). Longer-term, enforce repository token scope in a single route-group middleware wherever `AllowBasic` / `AllowOAuth2` is set on a repo-content route, so the next added endpoint cannot miss it.","state":0,"publishedAt":"2026-07-21T20:30:11+00:00","modifiedAt":"2026-07-22T21:11:24.5180836+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.26.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27761","https://github.com/go-gitea/gitea/pull/38147","https://github.com/go-gitea/gitea/commit/9e84deb969aff5c1115c2984e41250f28c78451f","https://blog.gitea.com/release-of-1.26.3-and-1.26.4","https://github.com/go-gitea/gitea","https://github.com/go-gitea/gitea/releases/tag/v1.26.3"],"sourceUrl":"https://github.com/advisories/GHSA-3pww-vcvm-3gmj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-3pww-vcvm-3gmj","identifiers":["GHSA-3pww-vcvm-3gmj","CVE-2026-27761","GO-2026-6031"]},"retained":false,"historicalAffected":[]},{"revision":"876103c9baa64e4a8d1a2001064ee6e8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6031","aliases":["CVE-2026-27761","GHSA-3pww-vcvm-3gmj"],"title":"Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea","description":"Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea","state":0,"publishedAt":"2026-07-22T20:36:35+00:00","modifiedAt":"2026-07-22T21:00:31.5132975+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.26.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27761","https://blog.gitea.com/release-of-1.26.3-and-1.26.4","https://github.com/go-gitea/gitea/commit/9e84deb969aff5c1115c2984e41250f28c78451f","https://github.com/go-gitea/gitea/pull/38147","https://github.com/go-gitea/gitea/releases/tag/v1.26.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6031","license":"OSV · upstream source license applies","key":"osv:GO-2026-6031","identifiers":["GO-2026-6031","CVE-2026-27761","GHSA-3pww-vcvm-3gmj"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:46.9707302+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.9707321+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-1766179264875bb4621a23ce4c6bcebec63fb794a16e35c2f5592f4ee300ee2e","complete":true,"records":420944,"lastAttemptAt":"2026-11-07T20:52:46.1142943+00:00","lastSuccessAt":"2026-11-07T20:52:46.0341312+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.1142943+00:00","snapshotPublishedAt":"2026-11-07T20:26:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cbfb00168958467aaa6015d5230faa08","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T21:04:54.6100336+00:00","lastSuccessAt":"2026-11-07T21:04:54.606+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:04:54.606+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:47.1482288+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:47.1482303+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b9464f9c589b4886928e7045b5ad1e11","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T20:52:54.6850231+00:00","lastSuccessAt":"2026-11-07T20:52:54.68+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:54.68+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T20:52:46.6024506+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.6024506+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T20:52:46.3552169+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.3552169+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T20:52:46.7261257+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.7261257+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T20:52:46.4923243+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.4923243+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}