Incorrect authorization in Gitea - CVE-2026-24791
Published: June 22, 2026
Vulnerability identifier: #VU134999
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-24791
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access or modify private account resources.
The vulnerability exists due to incorrect authorization in the /api/v1/user self routes when handling requests with public-only tokens that carry the route-required scopes. A remote user can send crafted API requests to access or modify private account resources.
The issue affects multiple self routes, including profile, email, SSH key, OAuth application, Actions, runner, webhook, team, timing, subscription, and private repository surfaces.
Affected software
Gitea
How to mitigate CVE-2026-24791
Install security update from vendor's website.
Gitea - update to 1.26.2