IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-08-13 17:17

MODIFIED

2026-08-13 17:17

EPSS (Prob. Exploit)

0.47%

Top 59.2%

DATA SOURCES:

NVD 🔗 2026-08-13 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 GITHUB 🔗 2026-10-29 OSV 🔗 2026-10-26

> DESCRIPTION

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-284 CWE-1259

> CWE DETAILED DESCRIPTIONS

CWE-284: Improper Access Control - The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. | CWE-1259: Improper Restriction of Security Token Assignment - The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected, such as improperly restricting the assignment to trusted components.

> GITHUB SECURITY ADVISORY

GHSA-fq2p-5p22-8g6j MODERATE

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

AFFECTED PACKAGES:

GO / code.gitea.io/gitea

< 1.27.0

Fixed in: 1.27.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

AFFECTED PACKAGES:

Unknown / Unknown

38 versions affected

ALIASES:

GHSA-fq2p-5p22-8g6j, GO-2026-6053

> HISTORIQUE DES MODIFICATIONS

Première apparition

13/08/2026 17:17

Source: NVD

📊 ENRICHISSEMENT 01/11/2026 06:59

CWE

Champ modifié: Description CWE

Ancienne valeur:

Nouvelle valeur:

📊 ENRICHISSEMENT 01/09/2026 06:02

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

Total des modifications: 2 Dernière mise à jour: 3 hours ago

> REFERENCES

https://blog.gitea.com/gitea-1.27.0-is-released/

https://github.com/go-gitea/gitea/releases/tag/v1.27.0

https://github.com/go-gitea/gitea/security/advisories/GHSA-fq2p-5p22-8g6j