CVE-2026-70407: Gitea organization listing token scope bypass
Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassing the intended restriction on the token's delegated access.
Affected Software
Event History
Frequently Asked Questions
Who is most exposed to this issue?
Instances where organization metadata is sensitive are affected, particularly when site administrator tokens are used with scopes intended to restrict delegated access. A site administrator token can return Limited and private organizations visible to that administrator.
What does an attacker need to exploit it?
The attacker needs a Gitea token that is valid for the organization-list API but lacks the intended read:organization scope, such as a token limited to read:misc. The API can return organization metadata visible to that token's owner despite the missing scope.
Does this expose every organization's data to any token holder?
No. The disclosed behavior returns organization metadata that is visible to the token owner. The elevated concern is for site administrator tokens, whose visibility can include Limited and private organizations.