CVE-2026-73126
CVE-2026-73126 · Gitea private workflow badge token scope bypass
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository accessible to its owner. This discloses private workflow status beyond the token's intended delegated permissions.
CVSS 4.3 · Media · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
gitea
- Versiones
- ≥ 0, ≤ 1.27.2: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/go-gitea/gitea/security/advisories/GHSA-r96c-jc75-rxv6
- https://blog.gitea.com/release-of-1.27.3/
- https://github.com/go-gitea/gitea/pull/39044
- https://github.com/go-gitea/gitea/pull/39058
- https://github.com/go-gitea/gitea/releases/tag/v1.27.3
- https://nvd.nist.gov/vuln/detail/CVE-2026-73126