CVE-2026-117635

Full vulnerability record from the local CVENow database.

Description

The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Deferred

Source identifier

88ee5874-cf24-4952-aea0-31affedb7ff2

Published

2026-11-01 10:18:35.320000

Last modified

2026-11-01 10:18:35.437000

View original CVE JSON

{
  "id": "CVE-2026-117635",
  "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2",
  "published": "2026-11-01T10:18:35.320",
  "lastModified": "2026-11-01T10:18:35.437",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API."
    }
  ],
  "affected": [
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "affectedData": [
        {
          "vendor": "Gitea",
          "product": "Gitea",
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "versions": [
            {
              "version": "0",
              "lessThan": "28.3.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-1259"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://blog.gitea.com/release-of-28.3.0/",
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    },
    {
      "url": "https://github.com/go-gitea/gitea/pull/39690",
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    },
    {
      "url": "https://github.com/go-gitea/gitea/pull/39853",
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    },
    {
      "url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0",
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    },
    {
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-37xv-m4w7-j2fh",
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    }
  ]
}