CVE-2026-70400 Details
Description
Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that user has the necessary permissions. The ordinary private repository-creation route rejects the same token, but the migration path omits that restriction.
A vulnerability in Gitea's repository migration API allows the misuse of public-only tokens to create private repositories. This issue arises because the migration endpoint does not enforce the same token restrictions as the standard private repository creation route. As a result, a token intended for public resources can be used to create private repositories and migration tasks under the user's account or an organization where the user has permissions.
Users can upgrade to Gitea version 1.27.3, which addresses this vulnerability by enforcing the correct token authorization for repository creation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-1.27.3/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39007 | Gitea Limited | Issue TrackingSource CodeVendor |
| https://github.com/go-gitea/gitea/pull/39014 | Gitea Limited | Issue TrackingSource CodeVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.3 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-x58h-3mx5-q44r | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 1.27.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | Gitea Limited |