Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117635— Gitea admin API public-only token scope bypass

Quick assessment

Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

路由组未对“仅限公开”（public-only）的个人访问令牌实施限制。因此，由站点管理员颁发的、具有管理范围且标记为“仅限公开”的令牌，能够列出私有组织及所有用户的电子邮件地址、创建组织、获取 Runner 注册令牌，甚至创建新的站点管理员账户；其中，新创建的站点管理员账户在令牌被撤销后依然保留。非站点管理员用户的令牌无法访问这些路由；目前，管理员 API 已拒绝所有“仅限公开”的令牌。

AI Predicted 9.8 Difficulty: Moderate

Affected Version Matrix 1

VendorProduct Version RangeStatus
Gitea Gitea < 28.3.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-117635

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Gitea admin API public-only token scope bypass
Source: CVE Program / CVE List V5
Vulnerability Description
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Gitea Gitea 0 ~ 28.3.0 -

II. Public POCs for CVE-2026-117635

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117635

请登录查看更多情报信息。

Other References for CVE-2026-117635 (5)

Same Patch Batch · Gitea · 2026-11-01 · 20 CVEs total

CVE-2026-117649 Gitea private issue disclosure through issue dependency timeline events
CVE-2026-118386 Gitea Actions fork workflow trust through pull request review commit
CVE-2026-120263 Gitea OAuth2 account auto-linking takeover through the sign-up form
CVE-2026-112887 Gitea Actions task token private repository enumeration
CVE-2026-113429 Gitea stored XSS through legacy Actions artifact Content-Encoding
CVE-2026-114199 Gitea contribution heatmap private activity disclosure to public-only tokens
CVE-2026-116289 Gitea public-only token bypass through Actions runner registration
CVE-2026-116296 Gitea archived repository release, milestone and label modification
CVE-2026-116474 Gitea Actions job token spoofing of instance-signed commits
CVE-2026-117646 Gitea private repository listing to public-only tokens on profiles
CVE-2026-119627 Gitea limited-visibility profile disclosure with public-only tokens
CVE-2026-117677 Gitea Helm chart upload decompression denial of service
CVE-2026-117685 Gitea public-only package token access to private OCI blobs
CVE-2026-118394 Gitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-118395 Gitea public-only token bypass in repository and organization creation
CVE-2026-118504 Gitea issue changes on archived repositories through the API
CVE-2026-119441 Gitea public-only token bypass on bulk organization repository deletion
CVE-2026-119533 Gitea private pull request disclosure on project boards
CVE-2026-119625 Gitea user and organization feed token scope bypass

IV. Related Vulnerabilities

Same product: Gitea
Same vendor: Gitea
Same weakness: CWE-284