CVE-2026-117635 Gitea CVE debrief

Who should care

Site administrators using Gitea should assess their exposure and verify their personal access token configurations. This vulnerability affects Gitea deployments where site administrators have issued public-only personal access tokens with admin scope. Operators, platform administrators, and security teams should review their configurations and update to version 28.3.0 or later to prevent unauthorized access.

Why it matters

CVE-2026-117635 is a vulnerability in Gitea that allows site administrators with public-only personal access tokens to perform unauthorized actions. Defenders should verify their configurations and update to version 28.3.0 or later.

• Potential unauthorized access to private organizations and user email addresses
• Possible creation of new organizations and site administrator accounts
• Required verification of personal access token configurations
• Necessity to update Gitea to version 28.3.0 or later

Technical summary

The `/api/v1/admin` route group in Gitea did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could list private organizations, obtain email addresses of all users, create organizations, obtain runner registration tokens, and create new site administrator accounts. This issue has been fixed in Gitea version 28.3.0. Site administrators should verify their personal access token configurations and update to the latest version. The vulnerability highlights the importance of proper token configuration and access control.

Defensive priority

Site administrators using Gitea should verify their personal access token configurations and update to version 28.3.0 or later.

Recommended defensive actions

• Verify personal access token configurations for site administrators
• Update Gitea to version 28.3.0 or later
• Review and restrict admin API access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is required to determine the full scope of the issue. The official CVE Program record and NVD detail page are provided for reference. Gitea release notes for version 28.3.0 and the pull request for the fix are also relevant. Defenders should verify their configurations and update to version 28.3.0 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.