CVE-2026-70396: Gitea organization repository creation token scope bypass
Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a personal access token or OAuth application token for a user who already has permission to create repositories in the target organization. The token must have write:organization, but does not need write:repository.
Does this allow repository creation in organizations where the token owner lacks access?
No. Repository creation remains subject to the authorizing user's organization permissions. The issue bypasses the token's intended repository-write scope boundary, not the organization's authorization checks.
Which API path is affected?
The affected path is Gitea's organization repository-creation API. Other repository-creation routes enforce the write:repository token scope.