CVE-2026-119441 Gitea public-only token bypass on bulk organization repository deletion
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119441?
CVE-2026-119441 is a high-severity vulnerability in Gitea, published on 1 Nov 2026.
Official description
`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently delete the organization's private repositories, which such a token must not reach. Routes that require organization ownership now reject public-only tokens.
Weakness: CWE-863
Which versions are affected by CVE-2026-119441?
How do I fix CVE-2026-119441?
No fix has been published for CVE-2026-119441 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119441 being exploited?
There is no known exploitation of CVE-2026-119441 in the wild and no public exploit code.
Sources
Also known as GHSA-jh8p-x4ch-389q.