CVE-2026-118395 Gitea CVE debrief

Who should care

Gitea administrators and users who utilize personal access tokens with restricted scopes should assess their exposure to this vulnerability and verify their deployments. Additionally, security teams and platform operators who manage Gitea instances should review their configurations and ensure that personal access tokens are properly restricted to prevent unauthorized actions.

Why it matters

Defenders should care about CVE-2026-118395 because it allows holders of public-only personal access tokens to create private repositories, organizations, and generate private repositories from templates in Gitea 1.27.3. This could lead to unauthorized repository creation and exposure of sensitive information. Gitea administrators and users who utilize personal access tokens with restricted scopes should assess their exposure and verify their deployments.

• Potential unauthorized creation of private repositories in Gitea organizations
• Possible creation of private organizations using restricted personal access tokens
• Potential generation of private repositories from templates with restricted tokens

Technical summary

Gitea 1.27.3 has a vulnerability where personal access tokens restricted to public resources (`public-only`) can still create private repositories in certain scenarios. The tokens can create private repositories in organizations where the token's owner has write access, create private organizations, and generate private repositories from templates through specific API endpoints. This vulnerability is due to the incomplete restriction of personal access tokens with `public-only` access, allowing them to interact with private resources in unintended ways.

Defensive priority

Defenders should prioritize verifying Gitea deployments using personal access tokens and assess exposure to unauthorized repository creation.

Recommended defensive actions

• Verify Gitea deployments using personal access tokens and assess exposure to unauthorized repository creation
• Review and restrict write scopes for personal access tokens
• Monitor for suspicious repository creation activity in Gitea organizations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Gitea 1.27.3, including the restricted functionality of personal access tokens and the specific API endpoints affected. The vulnerability is confirmed in Gitea 1.27.3 and may affect other versions. The CVE Program and NVD entries provide source-provided CVE metadata and vulnerability assessment. However, the exact scope and impact of the vulnerability are limited by the information available in the CVE record and NVD entry.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.