CVE-2026-70400

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that user has the necessary permissions. The ordinary private repository-creation route rejects the same token, but the migration path omits that restriction.

• CWE-863

• https://blog.gitea.com/release-of-1.27.3/
• https://github.com/go-gitea/gitea/pull/39007
• https://github.com/go-gitea/gitea/pull/39014
• https://github.com/go-gitea/gitea/releases/tag/v1.27.3
• https://github.com/go-gitea/gitea/security/advisories/GHSA-x58h-3mx5-q44r

Published

Oct 14, 2026

Last Modified

Oct 14, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7039A security vulnerability has been detected in tufantunc ssh-…7.8
• CVE-2026-70395Improper Neutralization of Special Elements in Data Query Lo…2.1
• CVE-2026-70396Gitea's organization repository-creation API requires write:…5.4
• CVE-2026-70398A flaw was found in multicloud-integrations, a component of …9.6
• CVE-2026-70399Allocation of Resources Without Limits or Throttling vulnera…8.7
• CVE-2026-7040Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl h…7.5
• CVE-2026-70402Gitea creates server-side Git hook directories and scripts w…5.8
• CVE-2026-70403XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE…9.3
• CVE-2026-70405Improper Validation of Specified Quantity in Input vulnerabi…6.3
• CVE-2026-70406Gitea's shared comparison helper omits the token repository-…6.5
• CVE-2026-70407Gitea's organization-list API does not enforce the read:orga…4.3
• CVE-2026-70408An incorrect authorization vulnerability exists in acmailer,…8.7