Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119441— Gitea public-only token bypass on bulk organization repository deletion

Quick assessment

Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

接口会删除组织下的所有仓库，但该接口此前未对访问令牌实施“仅限公开”的限制：它仅检查了组织本身是否为公开组织。因此，拥有公开组织的公开令牌持有者（即该组织的拥有者）可以永久删除该组织的私有仓库，而这些仓库本不应被此类令牌访问。目前，所有要求组织所有权的接口均已拒绝“仅限公开”的令牌。

AI Predicted 8.1 Difficulty: Easy

Affected Version Matrix 1

VendorProduct Version RangeStatus
Gitea Gitea 1.27.0< 28.3.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119441

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Gitea public-only token bypass on bulk organization repository deletion
Source: CVE Program / CVE List V5
Vulnerability Description
`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently delete the organization's private repositories, which such a token must not reach. Routes that require organization ownership now reject public-only tokens.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Gitea Gitea 1.27.0 ~ 28.3.0 -

II. Public POCs for CVE-2026-119441

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119441

请登录查看更多情报信息。

Other References for CVE-2026-119441 (5)

Same Patch Batch · Gitea · 2026-11-01 · 20 CVEs total

CVE-2026-117646 Gitea private repository listing to public-only tokens on profiles
CVE-2026-118386 Gitea Actions fork workflow trust through pull request review commit
CVE-2026-120263 Gitea OAuth2 account auto-linking takeover through the sign-up form
CVE-2026-112887 Gitea Actions task token private repository enumeration
CVE-2026-113429 Gitea stored XSS through legacy Actions artifact Content-Encoding
CVE-2026-114199 Gitea contribution heatmap private activity disclosure to public-only tokens
CVE-2026-116289 Gitea public-only token bypass through Actions runner registration
CVE-2026-116296 Gitea archived repository release, milestone and label modification
CVE-2026-116474 Gitea Actions job token spoofing of instance-signed commits
CVE-2026-117635 Gitea admin API public-only token scope bypass
CVE-2026-119627 Gitea limited-visibility profile disclosure with public-only tokens
CVE-2026-117649 Gitea private issue disclosure through issue dependency timeline events
CVE-2026-117677 Gitea Helm chart upload decompression denial of service
CVE-2026-117685 Gitea public-only package token access to private OCI blobs
CVE-2026-118394 Gitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-118395 Gitea public-only token bypass in repository and organization creation
CVE-2026-118504 Gitea issue changes on archived repositories through the API
CVE-2026-119533 Gitea private pull request disclosure on project boards
CVE-2026-119625 Gitea user and organization feed token scope bypass

IV. Related Vulnerabilities

Same product: Gitea
Same vendor: Gitea
Same weakness: CWE-863