CVE-2026-119441 Gitea CVE debrief

Who should care

Defenders who use Gitea should verify the affected versions and apply the necessary patches to prevent exploitation. Gitea administrators should restrict access to the DELETE /api/v1/orgs/{org}/repos route to only allow authorized users.

Why it matters

CVE-2026-119441 is a vulnerability in Gitea that allows for the deletion of all repositories of an organization using a public-only access token. Defenders should prioritize verifying the affected versions and applying patches.

• An attacker could delete all repositories of an organization using a public-only access token
• Defenders need to verify the affected versions of Gitea and apply the necessary patches
• Defenders should restrict access to the DELETE /api/v1/orgs/{org}/repos route to only allow authorized users

Technical summary

The DELETE /api/v1/orgs/{org}/repos route in Gitea does not enforce the public-only restriction of access tokens, allowing a public-only token of an owner of a public organization to permanently delete the organization's private repositories. This vulnerability exists because the route only checks if the organization is public, but does not verify the access token's scope. Defenders should prioritize verifying the affected versions of Gitea and applying the necessary patches to prevent exploitation. The vulnerability can be mitigated by restricting access to the DELETE /api/v1/orgs/{org}/repos route to only allow authorized users.

Defensive priority

Defenders should prioritize verifying the affected versions of Gitea and applying the necessary patches to prevent exploitation.

Recommended defensive actions

• Verify the affected versions of Gitea and apply the necessary patches
• Restrict access to the DELETE /api/v1/orgs/{org}/repos route to only allow authorized users
• Monitor for suspicious activity on the Gitea platform
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by an unknown source and is described in the CVE record and the Gitea security advisory. The affected versions of Gitea need to be verified by defenders. The CVE record was published on 2026-11-01T10:18:36.643Z and has not been modified since then. Evidence is limited to public sources and CVE details. Defenders should verify the Gitea security advisory for specific version information and apply necessary patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.