{"id":"CVE-2026-56443","revision":null,"records":[{"revision":"8babd5c57e3041b69bdcfd5d592c0e7b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-56443","aliases":[],"title":"Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118","description":"Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118","state":0,"publishedAt":"2026-08-13T16:44:42.458+00:00","modifiedAt":"2026-08-14T20:05:01.023+00:00","affected":[{"ecosystem":"Vendor product","name":"Gitea Open Source Git Server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Gitea\",\n                    \"product\": \"Gitea Open Source Git Server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"1.26.4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-7p4h-3gxq-x3h3","https://github.com/go-gitea/gitea/releases/tag/v1.27.0","https://blog.gitea.com/gitea-1.27.0-is-released/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-56443","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-56443","identifiers":["CVE-2026-56443"]},"retained":false,"historicalAffected":[]},{"revision":"d5de350bd9fa40139528b25e69e1d61b","observedAt":"2026-11-11T14:06:37.033+00:00","statement":{"source":"euvd","id":"EUVD-2026-58142","aliases":["CVE-2026-56443","GHSA-7p4h-3gxq-x3h3"],"title":"Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118","description":"Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","score":9.6,"severity":null}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-7p4h-3gxq-x3h3","https://github.com/go-gitea/gitea/releases/tag/v1.27.0","https://blog.gitea.com/gitea-1.27.0-is-released/"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58142","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 13, 2026, 4:44:42 PM","dateUpdated":"Aug 14, 2026, 8:05:01 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-58142","identifiers":["EUVD-2026-58142","CVE-2026-56443","GHSA-7p4h-3gxq-x3h3"]},"retained":false,"historicalAffected":[]},{"revision":"66645019845240259c4dc73785aeb908","observedAt":"2026-10-25T14:19:10.848+00:00","statement":{"source":"nvd","id":"CVE-2026-56443","aliases":[],"title":"Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118","description":"Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118","state":0,"publishedAt":"2026-08-13T17:17:25.247+00:00","modifiedAt":"2026-08-26T16:53:48.3+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","score":9.6,"severity":"CRITICAL"}],"references":["https://blog.gitea.com/gitea-1.27.0-is-released/","https://github.com/go-gitea/gitea/releases/tag/v1.27.0","https://github.com/go-gitea/gitea/security/advisories/GHSA-7p4h-3gxq-x3h3"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56443","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-863"],"productCriteria":[],"sourceDates":{"published":"2026-08-13T17:17:25.247","lastModified":"2026-08-26T16:53:48.300"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-56443","identifiers":["CVE-2026-56443"]},"retained":false,"historicalAffected":[]},{"revision":"03fc4c11307040c3933ebdf86913774e","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-7p4h-3gxq-x3h3","aliases":["CVE-2026-56443","GO-2026-6045"],"title":"Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118","description":"## Summary\n\nAfter [PR #37118](https://github.com/go-gitea/gitea/pull/37118) / **CVE-2026-25714**\n(`fix: Unify public-only token filtering in API queries and repo access checks`,\nmerged 2026-05-18, backport `#37773` to 1.26.2 — the May 2026 unification pass\nfor public-only token filtering, reporter Medoedus per the 1.26.2 release notes),\nthe `public-only` PAT scope is still bypassable on **Repository** and **Package**\nscope categories when the owner's `Visibility = Limited` (instance-internal).\n\nThe sibling `Org` / `User` / `ActivityPub` cases in the same `checkTokenPublicOnly`\nswitch correctly reject Limited owners via `!Visibility.IsPublic()`. The\nRepository / Package cases use `repo.IsPrivate` or `Owner.Visibility.IsPrivate()`,\nboth of which return `false` for `VisibleTypeLimited` — so a `public-only` PAT\nstrictly exceeds anonymous reach on a Limited owner.\n\nTested on `gitea/gitea:1.26.2`. The decisive marker is that PR #37118's\nunification IS applied in the version under test (User-category PROBE returns\n`403 \"token scope is limited to public users\"`). Despite that, the\nRepository-category PROBE on the same Limited owner with the same PAT returns\n`200` and serves content.\n\n## Affected entry points (4 spots)\n\n| File:Line | Function | Affected surface |\n|---|---|---|\n| `routers/api/v1/api.go:292` | `checkTokenPublicOnly` Package case | API v1 packages |\n| `routers/api/packages/api.go:76` | `reqPackageAccess` middleware | All 24 native package registries (`/api/packages/<type>/...`) |\n| `services/context/api.go` | `TokenCanAccessRepo` helper | All API v1 Repository-category endpoints — content, issues, PRs, releases, labels, milestones, etc. |\n| `services/context/permission.go:32` | `CheckTokenScopes` (called via `CheckRepoScopedToken`) | Web download endpoints `/raw`, `/media`, `/attachments`. LFS routes (`services/lfs/server.go:470/472`, `services/lfs/locks.go:62/151/216/284`) also chain through this helper. |\n\nAll four sinks check `repo.IsPrivate` or `Owner.Visibility.IsPrivate()` only.\n`VisibleTypeLimited` falls through.\n\n```go\n// modules/structs/visible_type.go\nfunc (vt VisibleType) IsPrivate() bool { return vt == VisibleTypePrivate }   // line 39-40\nfunc (vt VisibleType) IsLimited() bool { return vt == VisibleTypeLimited }   // line 33-34\n```\n\n## Same-file evidence (`routers/api/v1/api.go:246-299` after PR #37118)\n\n```go\ncase auth_model.AccessTokenScopeCategoryOrganization:\n    orgPrivate := ... && !ctx.Org.Organization.Visibility.IsPublic()        // !IsPublic ✓\ncase auth_model.AccessTokenScopeCategoryUser:\n    if ... && !ctx.ContextUser.Visibility.IsPublic() { ... }                // !IsPublic ✓\ncase auth_model.AccessTokenScopeCategoryActivityPub:\n    if ... && !ctx.ContextUser.Visibility.IsPublic() { ... }                // !IsPublic ✓\n\ncase auth_model.AccessTokenScopeCategoryPackage:\n    if ctx.Package != nil && ctx.Package.Owner.Visibility.IsPrivate() {     // IsPrivate ONLY ✗\n        ctx.APIError(http.StatusForbidden, \"token scope is limited to public packages\")\n        return\n    }\n```\n\n`TokenCanAccessRepo` (`services/context/api.go`) reduces to `!repo.IsPrivate`:\n\n```go\n// A public-only token cannot reach a private repo; any other token is unrestricted by this check.\nfunc (ctx *APIContext) TokenCanAccessRepo(repo *repo_model.Repository) bool {\n    return repo == nil || !ctx.PublicOnly || !repo.IsPrivate\n}\n```\n\n`CheckTokenScopes` (`services/context/permission.go:32`):\n\n```go\nif publicOnly && repo != nil && repo.IsPrivate {\n    ctx.HTTPError(http.StatusForbidden)\n    return\n}\n```\n\n## PoC (Docker e2e VERIFIED on `gitea/gitea:1.26.2`, 2026-06-05)\n\nFull script in the report (`run-poc.sh`). Setup:\n\n1. Create user `limuser`. `PATCH /api/v1/admin/users/limuser` with body\n   `{\"visibility\":\"limited\", ...}` — response confirms `\"visibility\":\"limited\"`.\n2. Upload a generic package as `limuser`:\n   `PUT /api/packages/limuser/generic/secretpkg/1.0.0/secret.txt` with body\n   `secret-content-internal-only` → `201`.\n3. Create user `attacker`.\n4. Mint PAT for `attacker` with `scopes=[\"read:package\",\"read:user\",\"read:repository\",\"public-only\"]`.\n\nResult on `gitea/gitea:1.26.2` — nine PROBEs:\n\n```\nPROBE A  (download package via attacker PAT)\n    HTTP=200  Body: secret-content-internal-only\n\nPROBE C  (read README of limuser's PUBLIC repo)\n    HTTP=200  Body: {\"name\":\"README.md\", ...}\n\nPROBE F  (sanity — User category, same PAT, same owner)\n    HTTP=403  Body: {\"message\":\"token scope is limited to public users\"}\n\nPROBE G  (Repository category, same PAT, same owner)\n    HTTP=200  Body: {\"name\":\"README.md\", ...}                    ← bypass\n\nPROBE H  (list limuser's repos, User category)\n    HTTP=403  Body: {\"message\":\"token scope is limited to public users\"}\n\nPROBE M  (git HTTPS smart protocol — info/refs)\n    HTTP=200  Body: 001e# service=git-upload-pack ... HEAD ...   ← full clone enabled\n\nPROBE N  (write attempt: POST contents/hacked.txt)\n    HTTP=403  Body: {\"message\":\"user should have a permission to write to the target branch\"}\n                                                                    Integrity:N confirmed\n\nPROBE O  (Limited ORG — same bypass class)\n    Org category    : HTTP=403  {\"message\":\"token scope is limited to public orgs\"}\n    Repo category   : HTTP=200  README content                  ← bypass\n\nAnonymous baseline (no auth) on every above endpoint: HTTP=401/404\n```\n\nGitea's own server error string in PROBE F / H / O — *\"token scope is limited\nto public users\"* / *\"public orgs\"* — is the explicit declaration of intent.\nRepository / Package category violates that intent on the same Limited owner.\n\n## Why this is not a duplicate of CVE-2026-25714\n\nCVE-2026-25714 / PR #37118 (the May 2026 unification pass for public-only token\nfiltering, merged 2026-05-18, backported to 1.26.2 via PR #37773) realigned\n`checkTokenPublicOnly`'s Org / User / ActivityPub cases on `!Visibility.IsPublic()`\nand introduced the `TokenCanAccessRepo` helper for the Repository / Issue /\nNotification cases.\n\nPROBE F on `1.26.2` returns `403 \"token scope is limited to public users\"` for\nthe User category — i.e. PR #37118's unification IS in effect on the version\nunder test. The Repository / Package leak occurs *after* that fix; the Limited\ngap is the next residual issue on the same hygiene effort (the Package case was\nnot touched, and `TokenCanAccessRepo` reduces to `!repo.IsPrivate` without\nconsulting owner visibility), not the same bug.\n\n## Suggested fix (4 spots, 1-line shape each)\n\n```go\n// routers/api/v1/api.go:292  (checkTokenPublicOnly Package case)\n- if ctx.Package != nil && ctx.Package.Owner.Visibility.IsPrivate() {\n+ if ctx.Package != nil && !ctx.Package.Owner.Visibility.IsPublic() {\n\n// routers/api/packages/api.go:76  (reqPackageAccess middleware)\n- if ctx.Package != nil && ctx.Package.Owner.Visibility.IsPrivate() {\n+ if ctx.Package != nil && !ctx.Package.Owner.Visibility.IsPublic() {\n\n// services/context/api.go  (TokenCanAccessRepo helper)\n- return repo == nil || !ctx.PublicOnly || !repo.IsPrivate\n+ return repo == nil || !ctx.PublicOnly ||\n+     (!repo.IsPrivate && repo.Owner != nil && repo.Owner.Visibility.IsPublic())\n\n// services/context/permission.go:32  (CheckTokenScopes)\n- if publicOnly && repo != nil && repo.IsPrivate {\n+ if publicOnly && repo != nil &&\n+     (repo.IsPrivate || (repo.Owner != nil && !repo.Owner.Visibility.IsPublic())) {\n```\n\nThis aligns the Repository / Package categories with the User / Org / ActivityPub\nsiblings already shipped in PR #37118.\n## Reporter\n\nJebeenLee","state":0,"publishedAt":"2026-07-21T20:17:19+00:00","modifiedAt":"2026-09-24T16:00:05.021532+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.27.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"gitea.dev","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.27.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-7p4h-3gxq-x3h3","https://nvd.nist.gov/vuln/detail/CVE-2026-56443","https://github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31","https://blog.gitea.com/gitea-1.27.0-is-released","https://github.com/go-gitea/gitea","https://github.com/go-gitea/gitea/releases/tag/v1.27.0"],"sourceUrl":"https://github.com/advisories/GHSA-7p4h-3gxq-x3h3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-7p4h-3gxq-x3h3","identifiers":["GHSA-7p4h-3gxq-x3h3","CVE-2026-56443","GO-2026-6045"]},"retained":false,"historicalAffected":[]},{"revision":"826b077cf5d44ab8a9c921d755b802b2","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6045","aliases":["CVE-2026-56443","GHSA-7p4h-3gxq-x3h3"],"title":"Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository\n+ Package categories) — residual after CVE-2026-25714 / PR #37118 in gitea.dev","description":"Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository\n+ Package categories) — residual after CVE-2026-25714 / PR #37118 in gitea.dev","state":0,"publishedAt":"2026-07-22T20:36:35+00:00","modifiedAt":"2026-07-22T21:00:31.5012885+00:00","affected":[{"ecosystem":"Go","name":"gitea.dev","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.27.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-7p4h-3gxq-x3h3","https://github.com/go-gitea/gitea/releases/tag/v1.27.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6045","license":"OSV · upstream source license applies","key":"osv:GO-2026-6045","identifiers":["GO-2026-6045","CVE-2026-56443","GHSA-7p4h-3gxq-x3h3"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T12:55:42.4262761+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T12:55:42.4262761+00:00","lastSuccessAt":"2026-11-12T12:55:42.5974366+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:55:42.5974423+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-5bccd177289498505bca058c1d1f630384f5399f00540fa3e5d47f20d2a6ab62","complete":true,"records":424657,"lastAttemptAt":"2026-11-12T12:53:35.4399876+00:00","lastSuccessAt":"2026-11-12T12:53:35.3826245+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:53:35.4399876+00:00","snapshotPublishedAt":"2026-11-12T12:31:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0580dcc98aaa46a8935f8ff576f25037","complete":true,"records":13764,"lastAttemptAt":"2026-11-12T12:56:08.7918389+00:00","lastSuccessAt":"2026-11-12T11:56:20.209+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:56:20.209+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13817,"expectedIdentifiers":13817,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T12:55:42.4262761+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T12:55:42.4262761+00:00","lastSuccessAt":"2026-11-12T12:55:42.5982202+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:55:42.5982204+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8e24d21c65544232af203e5ab569fc84","complete":false,"records":13764,"lastAttemptAt":"2026-11-12T12:56:08.0805262+00:00","lastSuccessAt":"2026-11-12T12:56:08.077+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:56:08.077+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13313,"expectedIdentifiers":13817,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T12:55:42.268774+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:55:42.268774+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T12:53:36.536519+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:53:36.536519+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f46f74c6a30a9b6e4cfb481719c6d35521ebec2d53ebf163223d093ae587eb9d","complete":true,"records":3106,"lastAttemptAt":"2026-11-12T12:55:42.3839893+00:00","lastSuccessAt":"2026-11-12T09:55:31.1176285+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:55:42.3839893+00:00","snapshotPublishedAt":"2026-11-12T09:48:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-9fe0abab1a1e38846a00931efa6f1538c21ec4cb4a790552d5b52b39478d28ca","complete":true,"records":231701,"lastAttemptAt":"2026-11-12T12:55:42.1436747+00:00","lastSuccessAt":"2026-11-12T12:55:40.1640864+00:00","error":null,"lastVerifiedAt":"2026-11-12T12:55:42.1436747+00:00","snapshotPublishedAt":"2026-11-12T12:33:30+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}