CVE-2026-117635
Description
A flaw was found in Gitea. The administrative application programming interface (API) does not properly enforce public-only restrictions on personal access tokens. An authenticated attacker possessing a restricted administrator token can bypass these limitations to perform unauthorized administrative operations. This can lead to privilege escalation, enabling the attacker to create persistent administrator accounts, access private organization data, and disclose user email addresses.
Statement
Red Hat has evaluated this vulnerability as an Important severity issue because a compromised or intentionally restricted administrative credential can be leveraged remotely to achieve full instance control without further authorization. Exploitation requires high privileges as a prerequisite, specifically an existing site administrator token configured with constrained visibility scopes, meaning standard unprivileged users cannot reach these administrative endpoints. In Red Hat environments incorporating Gitea integration components, the impact applies primarily where instances host administrative routes, whereas standard pipeline integration workloads do not expose the vulnerable endpoint handlers.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
