CVE-2026-70396: Gitea organization repository creation token scope bypass

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-18
Weakness: CWE-863

Description

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions.

Affected products

Gitea Open Source Git Server: through 1.27.2

References

https://blog.gitea.com/release-of-1.27.3/
https://github.com/go-gitea/gitea/pull/39007
https://github.com/go-gitea/gitea/pull/39014
https://github.com/go-gitea/gitea/releases/tag/v1.27.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-hxhc-246f-rvqc

Get alerted when CVE-2026-70396 or the next vulnerability affects your stack