CVE-2026-117635 Details
Description
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.
A vulnerability exists in Gitea's admin API that allows public-only access tokens with admin scope to bypass restrictions on private resources. This flaw is present in Gitea versions through 28.2.0. The issue arises because the admin API does not enforce the public-only token restriction, enabling unauthorized access to private organizations, user email addresses, and the ability to create new site administrator accounts. Notably, the newly created admin accounts remain active even after the token is revoked.
Users can upgrade to Gitea version 28.3.0, where this vulnerability has been fixed. Instructions for downloading Gitea 28.3.0 are available on the Gitea releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-28.3.0/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39690 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/39853 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v28.3.0 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-37xv-m4w7-j2fh | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1259 | Improper Restriction of Security Token Assignment | Gitea Limited |
| CWE-284 | Improper Access Control | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 28.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | Gitea Limited |