CVE-2026-117635
Gitea admin API public-only token scope bypass
- Published
- Updated
- Reserved
- Assigned by
- Gitea
Description
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Deferred.
- EPSS (exploitation in 30 days)
- 0.15% · top 96% of all CVEs (5 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Weakness
Affected products
References (5)
- GitHub Security Advisory GHSA-37xv-m4w7-j2fh (opens in a new tab)vendor-advisory
- Fix: go-gitea/gitea pull request #39690 (opens in a new tab)patch
- Fix backport to release/v28: go-gitea/gitea pull request #39853 (opens in a new tab)patch
- Gitea 28.3.0 release announcement (opens in a new tab)release-notes
- go-gitea/gitea v28.3.0 release (opens in a new tab)release-notes
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-117635)Record last updated .