CVE-2026-70396 Details

A vulnerability in Gitea's organization repository creation API allows for unauthorized creation of organization-owned repositories. The API endpoint `POST /api/v1/orgs/{org}/repos` requires only the `write:organization` token scope, omitting the `write:repository` scope that is enforced on other repository creation routes. As a result, a personal access token or OAuth application token without repository write permissions can still create repositories within an organization, provided the user has the necessary organizational permissions. This issue bypasses the intended scope restrictions while remaining subject to the user's organization privileges.

Users can upgrade to Gitea version 1.27.3, which addresses this vulnerability by enforcing the correct token scopes for repository creation in organizations.