https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T21:11:49.710272+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/bdu:2026-15832 bdu:2026-15832 2026-10-08T21:11:49.945114+00:00 bdu:2026-15832 https://vulnerability.circl.lu/vuln/fkie_cve-2026-56443 fkie_cve-2026-56443 2026-10-08T21:11:49.945177+00:00

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

 https://vulnerability.circl.lu/vuln/ghsa-7p4h-3gxq-x3h3 GHSA-7p4h-3gxq-x3h3 — Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after… 2026-10-08T21:11:49.945230+00:00

Affected: Go: code.gitea.io/gitea, Go: gitea.dev

## Summary

After [PR #37118](https://github.com/go-gitea/gitea/pull/37118) / **CVE-2026-25714** (`fix: Unify public-only token filtering in API queries and repo access checks`, merged 2026-05-18, backport `#37773` to 1.26.2 — the May 2026 unification pass for public-only token filtering, reporter Medoedus per the 1.26.2 release notes), the `public-only` PAT scope is still bypassable on **Repository** and **Package** scope categories when the owner's `Visibility = Limited` (instance-internal).

The sibling `Org` / `User` / `ActivityPub` cases in the same `checkTokenPublicOnly` switch correctly reject Limited owners via `!Visibility.IsPublic()`. The Repository / Package cases use `repo.IsPrivate` or `Owner.Visibility.IsPrivate()`, both of which return `false` for `VisibleTypeLimited` — so a `public-only` PAT strictly exceeds anonymous reach on a Limited owner.

Tested on `gitea/gitea:1.26.2`. The decisive marker is that PR #37118's unification IS applied in the version under test (User-category PROBE returns `403 "token scope is limited to public users"`). Despite that, the Repository-category PROBE on the same Limited owner with the same PAT returns `200` and serves content.

## Affected entry points (4 spots)

| File:Line | Function | Affected surface | |---|---|---| | `routers/api/v1/api.go:292` | `checkTokenPublicOnly` Package case | API v1 packages | | `routers/api/packages/api.go:76` | `reqPackageAccess` middleware | All 24 native package registries (`/api/packages/<typ…