CVE-2026-70400: Gitea private migration creation with public-only tokens
Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that user has the necessary permissions. The ordinary private repository-creation route rejects the same token, but the migration path omits that restriction.
Affected Software
Event History
Frequently Asked Questions
Which destinations can be affected by this permission bypass?
A private repository and its migration task can be created under the account that authorized the token. An organization can also be affected when the token's user has the necessary permissions in that organization.
What does an attacker need to trigger the issue?
They need a delegated token intended to operate only on public resources and access to the repository migration API. The migration request must specify that the destination repository is private.
Is the same token accepted for normal private repository creation?
No. The ordinary private repository-creation route rejects the public-only token; the missing restriction is specific to the migration path.