The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sun, 01 Nov 2026 10:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API. | |
| Title | Gitea admin API public-only token scope bypass | |
| Weaknesses | CWE-1259 CWE-284 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-11-01T09:48:40.375Z
Reserved: 2026-11-01T08:48:41.152Z
Link: CVE-2026-117635
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-01T10:18:35.320
Modified: 2026-11-01T10:18:35.437
Link: CVE-2026-117635
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-01T11:30:06Z