Incorrect authorization in Gitea - CVE-2026-70400
Published: August 31, 2026
Vulnerability identifier: #VU146369
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70400
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to create private repositories and consume namespace or quota resources.
The vulnerability exists due to incorrect authorization in the repository migration endpoint when handling repository migration requests that set private: true while using a public-only token. A remote user can send a crafted migration request to create private repositories and consume namespace or quota resources.
The issue affects delegated tokens intended to be limited to public resources and can also start migration tasks under the authorizing account or an owned organization.
Affected software
Gitea
How to mitigate CVE-2026-70400
Install security update from vendor's website.
Gitea - update to 1.27.3