CVE-2026-50105

Published: Aug 13, 2026Modified: Aug 26, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://blog.gitea.com/gitea-1.27.0-is-released/

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/releases/tag/v1.27.0

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/security/advisories/GHSA-6cqf-375w-639g

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/security/advisories/GHSA-6cqf-375w-639g

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.