{"id":"GHSA-8629-vc8r-5p58","revision":"2cb50288466347e9b61768fc405cc021","records":[{"revision":"2cb50288466347e9b61768fc405cc021","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-8629-vc8r-5p58","aliases":["CVE-2026-25714","GO-2026-5243"],"title":"Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw","description":"## Summary\n\nTwo related issues in the token public-only scope enforcement introduced by PR #32204 (CVE-2025-68941 fix). A public-only scoped API token can access private organization data.\n\n## Issue 1: /user/orgs missing checkTokenPublicOnly()\n\n`routers/api/v1/api.go` line 1599:\n```go\nm.Get(\"/user/orgs\", reqToken(), tokenRequiresScopes(\n    auth_model.AccessTokenScopeCategoryUser,\n    auth_model.AccessTokenScopeCategoryOrganization,\n), org.ListMyOrgs)\n// Missing checkTokenPublicOnly()\n```\n\nAdjacent route at line 1603 has it:\n```go\nm.Group(\"/users/{username}/orgs\", func() { ... },\n    ..., checkTokenPublicOnly())\n```\n\n## Issue 2: checkTokenPublicOnly switch-case evaluates only first matching category\n\n`routers/api/v1/api.go` lines 253-295. Go switch executes only the first matching case. For routes with categories [User, Organization]:\n\n1. Organization case matches first (line 263)\n2. ctx.Org.Organization is nil on user routes, passes\n3. ctx.ContextUser.IsOrganization() is false, passes\n4. User case (line 273) is never reached\n5. User visibility check skipped entirely\n\n## Steps to Reproduce\n\n1. Create a token with public-only scope (Settings > Applications > check \"public only\")\n2. Call: `curl -H \"Authorization: token <PUBLIC_ONLY_TOKEN>\" https://gitea.example.com/api/v1/user/orgs`\n3. Response includes private and limited-visibility organizations\n\nExpected: only public organizations returned.\n\n## Impact\n\nPublic-only scoped tokens can enumerate private organizations the token owner belongs to. Violates the token's declared scope constraints.\n\n## Suggested Fix\n\n1. Add `checkTokenPublicOnly()` to `/user/orgs` route at line 1599\n2. Replace switch with loop over all categories so User visibility check is not skipped\n\n## Version\n\nCurrent main branch, commit 2c2d7e6 (April 3, 2026).","state":0,"publishedAt":"2026-06-16T23:41:31+00:00","modifiedAt":"2026-06-25T19:56:08.0614632+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.26.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-8629-vc8r-5p58","https://github.com/go-gitea/gitea"],"sourceUrl":"https://github.com/advisories/GHSA-8629-vc8r-5p58","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8629-vc8r-5p58","identifiers":["GHSA-8629-vc8r-5p58","CVE-2026-25714","GO-2026-5243"]},"retained":false,"historicalAffected":[]}],"coverage":[]}