CVE-2026-119625 Gitea user and organization feed token scope bypass
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119625?
CVE-2026-119625 is a medium-severity vulnerability in Gitea, published on 1 Nov 2026.
Official description
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site administrator's token this applied to every account. Tokens are now accepted on this route only for feeds, which require `read:user` or `read:organization`.
Weakness: CWE-863
Which versions are affected by CVE-2026-119625?
How do I fix CVE-2026-119625?
No fix has been published for CVE-2026-119625 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119625 being exploited?
There is no known exploitation of CVE-2026-119625 in the wild and no public exploit code.
Sources
Also known as GHSA-3fv3-hhmm-4x2q.