VDB
CVE-2026-70396
CVE-2026-70396
PUBLISHED
CVSS 5.4 MEDIUM
Reported by Gitea · Published October 14, 2026
Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions.
Risk Scores
CVSS 3.1
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitea | Gitea | 0 |
| alpine | gitea | 0 |
| Gitea | Gitea | 0 |
Timeline
- Oct 14, 2026 CVE Published
- Oct 15, 2026 EPSS Score
- Oct 18, 2026 CVE Updated
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Nov 3, 2026 EPSS Score
References
- GitHub Security Advisory GHSA-hxhc-246f-rvqc vendor-advisory
- Gitea 1.27.3 release announcement release-notes
- Fix: go-gitea/gitea pull request #39007 patch
- Fix: go-gitea/gitea pull request #39014 patch
- go-gitea/gitea v1.27.3 release release-notes