Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2026-25714

Gitea user organization API bypasses public-only token filtering

Description

Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Gitea Gitea Open Source Git Server

Default version status: unaffected

  • 0 to ≤ 1.26.1affected

References