Missing Authorization in Gitea - CVE-2026-50105
Published: July 14, 2026
Vulnerability identifier: #VU137422
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-50105
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in RSS/Atom feed handlers when processing API-token Basic authentication requests for feed routes. A remote user can use a public-only or wrong-scope personal access token to disclose sensitive information.
The issue affects feed endpoints that expose private commit metadata, release or tag notes, and the token owner's private activity stream, while normal repository read checks are still enforced.
Affected software
Gitea
How to mitigate CVE-2026-50105
Install security update from vendor's website.
Gitea - update to 1.27.0