Description

Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.

Related CPE's

Could not find any relations

References

https://blog.gitea.com/release-of-1.26.2/

https://github.com/go-gitea/gitea/pull/37735

https://github.com/go-gitea/gitea/releases/tag/v1.26.2

https://github.com/go-gitea/gitea/security/advisories/GHSA-cr4g-f395-h25h

https://github.com/go-gitea/gitea/security/advisories/GHSA-cr4g-f395-h25h

Weaknesses

88ee5874-cf24-4952-aea0-31affedb7ff2

Secondary
CWE-284

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.1 · Critical

Information

Source identifier

88ee5874-cf24-4952-aea0-31affedb7ff2

Vulnerability status

Deferred

Published

2026-07-03T21:16:56.433Z

3 months ago

Last modified

2026-07-06T19:17:00.120Z

3 months ago