CVE-2026-70406

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head repository accessible to the token owner. This bypasses the token's public-only restriction; it does not remove the account's underlying repository permission checks.

• CWE-863

• https://blog.gitea.com/release-of-1.27.3/
• https://github.com/go-gitea/gitea/pull/39006
• https://github.com/go-gitea/gitea/pull/39013
• https://github.com/go-gitea/gitea/releases/tag/v1.27.3
• https://github.com/go-gitea/gitea/security/advisories/GHSA-m78w-jjjx-gp8r

Published

Oct 14, 2026

Last Modified

Oct 14, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-70399Allocation of Resources Without Limits or Throttling vulnera…8.7
• CVE-2026-7040Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl h…7.5
• CVE-2026-70400Gitea's repository migration API accepts a public-only token…5.4
• CVE-2026-70402Gitea creates server-side Git hook directories and scripts w…5.8
• CVE-2026-70403XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE…9.3
• CVE-2026-70405Improper Validation of Specified Quantity in Input vulnerabi…6.3
• CVE-2026-70407Gitea's organization-list API does not enforce the read:orga…4.3
• CVE-2026-70408An incorrect authorization vulnerability exists in acmailer,…8.7
• CVE-2026-70409Improper Validation of Specified Quantity in Input vulnerabi…6.3
• CVE-2026-7041A vulnerability was detected in 666ghj MiroFish up to 0.1.2.…3.7
• CVE-2026-70410Use of Externally-Controlled Input to Select Classes or Code…8.8
• CVE-2026-70411Dell Container Storage Modules (CSM), versions prior to 1.18…6.5