https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:19:16 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-58444 <p>Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents</p> <p>Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-58444 https://vulnerability.circl.lu/vuln/ghsa-cp3q-vrj2-ghhh <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary A personal access token (PAT) or OAuth2 token that does **not** carry the `repository` scope or that is **public-only** is correctly rejected (HTTP 403) by the recently hardened web content routes (archive download, raw/media file download, and repository RSS/Atom feeds). However, the repository home page route `GET /{owner}/{repo}` (handler `repo.Home`) serves the **private** repository&#39;s rendered README, root file/directory tree, description, language statistics, license, and latest-release information to that same token.</p> <p>This is a token-scope enforcement bypass and private-repository content disclosure. It is the same source→sink pattern already fixed for neighbouring routes in:</p> <p>- **GHSA-cr4g-f395-h25h** (CVE-2026-20706) token scope bypass on web archive download - **GHSA-3pww-vcvm-3gmj** (CVE-2026-27761) token scope bypass on repository RSS/Atom feeds</p> <p>`repo.Home` is the remaining token-auth-enabled content route that was not given the guard.</p> <p>### Details / Root cause Web routes accept token authentication only when explicitly opted in with `webAuth.AllowBasic` / `webAuth.AllowOAuth2`. The repository home route carries `AllowBasic` (added so that `go get` can resolve private modules):</p> <p>```go // routers/web/web.go:1256 m.Get(&#34;/{username}/{reponame}&#34;, optSignIn, webAuth.AllowBasic, context.RepoAssignment, context.RepoRefByType(git.RefTypeBranch), repo.SetEditorconfigIfExists, repo.Home) ```</p> <p>When a PAT/OAuth2 token is supplied via HTTP Basic auth,…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary A personal access token (PAT) or OAuth2 token that does **not** carry the `repository` scope or that is **public-only** is correctly rejected (HTTP 403) by the recently hardened web content routes (archive download, raw/media file download, and repository RSS/Atom feeds). However, the repository home page route `GET /{owner}/{repo}` (handler `repo.Home`) serves the **private** repository&#39;s rendered README, root file/directory tree, description, language statistics, license, and latest-release information to that same token.</p> <p>This is a token-scope enforcement bypass and private-repository content disclosure. It is the same source→sink pattern already fixed for neighbouring routes in:</p> <p>- **GHSA-cr4g-f395-h25h** (CVE-2026-20706) token scope bypass on web archive download - **GHSA-3pww-vcvm-3gmj** (CVE-2026-27761) token scope bypass on repository RSS/Atom feeds</p> <p>`repo.Home` is the remaining token-auth-enabled content route that was not given the guard.</p> <p>### Details / Root cause Web routes accept token authentication only when explicitly opted in with `webAuth.AllowBasic` / `webAuth.AllowOAuth2`. The repository home route carries `AllowBasic` (added so that `go get` can resolve private modules):</p> <p>```go // routers/web/web.go:1256 m.Get(&#34;/{username}/{reponame}&#34;, optSignIn, webAuth.AllowBasic, context.RepoAssignment, context.RepoRefByType(git.RefTypeBranch), repo.SetEditorconfigIfExists, repo.Home) ```</p> <p>When a PAT/OAuth2 token is supplied via HTTP Basic auth,…</p> https://vulnerability.circl.lu/vuln/ghsa-cp3q-vrj2-ghhh