CVE-2026-70396 — Gitea organization repository creation token scope bypass
Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal acce…
Published: 2026-10-14 · CVSS: 5.4 · CVSS 3.1
Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7