CVE-2026-25714: Gitea Auth Bypass Vulnerability

CVE-2026-25714 Overview

CVE-2026-25714 affects Gitea versions up to and including 1.26.1. The vulnerability stems from inconsistent application of public-only token filtering on the user organization API endpoint. This represents an incomplete fix for the earlier CVE-2025-68941 disclosure. An authenticated attacker holding a public-only scoped token can query the user organization API and receive organization membership data that should be restricted. The issue is classified under [CWE-862: Missing Authorization]. Gitea addressed the flaw in release 1.26.2 by extending the token filtering logic to cover the affected API path.

Critical Impact
An attacker with a low-privilege public-only API token can enumerate private organization memberships that the token scope should exclude, resulting in limited confidentiality loss.

Affected Products

Gitea 1.26.1 and all earlier releases in the 1.26.x branch
Gitea instances exposing the user organization API to token-authenticated clients
Self-hosted Gitea deployments relying on public-only scoped tokens for third-party integrations

Discovery Timeline

2026-07-03 - CVE-2026-25714 published to the National Vulnerability Database
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-25714

Vulnerability Analysis

Gitea supports scoped API tokens, including a public-only mode that restricts responses to data marked as publicly visible. The prior fix for CVE-2025-68941 applied this filter across most user-facing API surfaces. However, the user organization API path did not honor the same restriction. When a client authenticates with a public-only token and calls the user organization endpoint, Gitea returns organization memberships without filtering out private memberships. This results in an authorization gap between the declared token scope and the enforced backend behavior.

Root Cause

The root cause is a missing authorization check on a specific API handler, mapped to [CWE-862]. The public-only enforcement logic was implemented as per-endpoint filtering rather than a centralized policy. When developers extended the API surface, the user organization handler did not inherit the filter. The gap remained undetected until post-release analysis of the CVE-2025-68941 patch coverage.

Attack Vector

Exploitation requires a valid Gitea API token with public-only scope. The attacker sends an authenticated HTTP request to the affected user organization endpoint. Gitea responds with the full list of organizations the target user belongs to, including private organization memberships. No user interaction or elevated privileges are required beyond token possession. The vulnerability does not permit modification of data or impact service availability. See the GitHub Security Advisory GHSA-8629 and the remediation pull request #37118 for technical implementation details.

Detection Methods for CVE-2026-25714

Indicators of Compromise

API access logs showing authenticated calls to user organization endpoints from tokens flagged with public-only scope.
Unexpected enumeration patterns where a single token queries organization membership for many distinct usernames in a short window.
Third-party integrations receiving organization membership data inconsistent with their expected read scope.

Detection Strategies

Audit Gitea access logs for requests to /api/v1/users/{username}/orgs correlated with token scope metadata.
Compare API response payloads returned to public-only tokens against the organizations flagged as private in the database.
Deploy log ingestion into a SIEM to alert on high-volume organization enumeration from a single token identifier.

Monitoring Recommendations

Track token creation events and maintain an inventory of tokens carrying public-only scope.
Monitor Gitea version banner responses to identify instances still running 1.26.1 or earlier.
Alert on newly issued API tokens making rapid successive calls to user metadata endpoints post-issuance.

How to Mitigate CVE-2026-25714

Immediate Actions Required

Upgrade all Gitea instances to version 1.26.2 or later without delay.
Rotate API tokens that were issued with public-only scope while the vulnerable version was deployed.
Review organization membership disclosure logs for the affected token set and notify impacted users if exposure is confirmed.

Patch Information

Gitea released version 1.26.2 containing the fix. Details are available in the Gitea 1.26.2 release notes and the GitHub release page for v1.26.2. The corrective code change is tracked in pull request #37118, which extends public-only token filtering to the user organization API handler.

Workarounds

Restrict token issuance policies so public-only tokens are not created until the upgrade completes.
Place the Gitea API behind a reverse proxy that blocks unauthenticated or externally originated requests to user organization endpoints.
Revoke existing public-only tokens and reissue them only after confirming the instance runs 1.26.2 or later.

bash

# Verify Gitea version and upgrade
gitea --version

# Docker upgrade example
docker pull gitea/gitea:1.26.2
docker stop gitea && docker rm gitea
docker run -d --name gitea \
  -v /var/lib/gitea:/data \
  -p 3000:3000 -p 222:22 \
  gitea/gitea:1.26.2

# Revoke and audit existing public-only tokens via API
curl -H "Authorization: token $ADMIN_TOKEN" \
  https://gitea.example.com/api/v1/users/$USER/tokens