CVE-2026-24791

HIGH

Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-24791 has a selected CVSS score of 8.1 (high).

Description

Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Gitea Open Source Git Server

Browse Gitea / Gitea Open Source Git Server

Default status: unaffected

CVE List1.22.3 to ≤ 1.26.1affected

code.gitea.io/gitea

Browse Go / code.gitea.io/gitea
GitHub Advisory1.22.3 to < 1.26.2 · Fixed in 1.26.2affected

References

5