CVE-2026-70396

— UNSCOREDpublic exploit available

Published 2026-10-14 · Updated 2026-10-14

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions.

Weaknesses

CWE-863

Public exploit & PoC references

https://github.com/go-gitea/gitea/pull/39007
https://github.com/go-gitea/gitea/pull/39014
https://github.com/go-gitea/gitea/releases/tag/v1.27.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-hxhc-246f-rvqc

All references

https://blog.gitea.com/release-of-1.27.3/
https://github.com/go-gitea/gitea/pull/39007
https://github.com/go-gitea/gitea/pull/39014
https://github.com/go-gitea/gitea/releases/tag/v1.27.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-hxhc-246f-rvqc

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2024-22031PoC
MEDIUMCVE-2026-100259
HIGHCVE-2026-100262
LOWCVE-2026-100270
HIGHCVE-2026-100273
MEDIUMCVE-2026-100276
HIGHCVE-2026-100277
MEDIUMCVE-2026-100278

Related by shared AI tags and CWE weakness class. Browse the full archive.