CVE-2026-119441 Details
Description
`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently delete the organization's private repositories, which such a token must not reach. Routes that require organization ownership now reject public-only tokens.
A vulnerability exists in Gitea's DELETE /api/v1/orgs/{org}/repos endpoint, which allows public-only access tokens of organization owners to delete private repositories. The endpoint fails to enforce the public-only restriction on individual repositories, only checking the organization's overall visibility. As a result, a public-only token can irreversibly delete private repositories, violating the intended access control. This issue affects Gitea versions 1.27.0 through 28.2.0 and has been patched in version 28.3.0.
Users can upgrade to Gitea version 28.3.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-28.3.0/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39690 | Gitea Limited | Source CodeVendor |
| https://github.com/go-gitea/gitea/pull/39853 | Gitea Limited | Source CodeVendor |
| https://github.com/go-gitea/gitea/releases/tag/v28.3.0 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-jh8p-x4ch-389q | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | >= 1.27.0, <= 28.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | Gitea Limited |