Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-117635 EUVD-2026-114797

Gitea admin API public-only token scope bypass

Published Nov 1, 2026 · Updated Nov 6, 2026 · Assigned by Gitea

Vendor: Gitea Product: Gitea

Description

The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.

Affected products

VendorProductAffectedFixed
Gitea Gitea < 28.3.0 28.3.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References