CVE-2026-116289
Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the…
- Risk score
- 60/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 1 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Gitea did not reject personal access tokens restricted to public resources (public-only) on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that belongs to an owner …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with `write:organization` that belongs to an owner of a public organization, an attacker could register an organization-level runner and receive jobs of the organization's private repositories that have Actions enabled, including the workflow content, Actions secrets and variables, and a task token with access to the private repository. The issue widens what the restricted token can reach; it gives nothing beyond what the owner's full account can already do.
Last activity 1 Nov 2026. Patch Forecast updates every hour.