Vulnerability-Lookup

CVE-2026-20706 (GCVE-0-2026-20706)

Vulnerability from cvelistv5 – Published: 2026-07-03 20:19 – Updated: 2026-07-03 20:19

Title

Gitea repository archive downloads bypass token scope checks

Summary

Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.

Severity ?

No CVSS data available.

CWE

CWE-284

Assigner

Gitea

References

URL

Tags

	https://github.com/go-gitea/gitea/security/adviso…	vendor-advisory
	https://github.com/go-gitea/gitea/pull/37735	patch
	https://github.com/go-gitea/gitea/releases/tag/v1.26.2	release-notes
	https://blog.gitea.com/release-of-1.26.2/	release-notes

Impacted products

	Vendor	Product	Version
	Gitea	Gitea Open Source Git Server	Affected: 0 , ≤ 1.26.1 (semver)

Credits

geoo115

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Gitea Open Source Git Server",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThanOrEqual": "1.26.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "geoo115"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-03T20:19:28.868Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-cr4g-f395-h25h"
        },
        {
          "name": "GitHub Pull Request #37735",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/37735"
        },
        {
          "name": "Gitea v1.26.2 Release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.2"
        },
        {
          "name": "Gitea v1.26.2 Release Blog Post",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-1.26.2/"
        }
      ],
      "title": "Gitea repository archive downloads bypass token scope checks",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-20706",
    "datePublished": "2026-07-03T20:19:28.868Z",
    "dateReserved": "2026-03-03T03:25:59.955Z",
    "dateUpdated": "2026-07-03T20:19:28.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-CR4G-F395-H25H

Vulnerability from github – Published: 2026-06-16 23:42 – Updated: 2026-06-16 23:42

Summary

Gitea: Token scope bypass on web archive download endpoint

Details

Summary

PR #37698 added checkDownloadTokenScope to /raw/, /media/, and attachment download web endpoints. The /archive/* endpoint (repo.Download in routers/web/repo/repo.go:372) was not included in the fix. This endpoint accepts OAuth2 tokens via webAuth.AllowOAuth2 (registered at routers/web/web.go:1649-1652) but does not call checkDownloadTokenScope or CheckRepoScopedToken.

A personal access token with any non-repository scope (e.g., read:issue or read:misc) can download full repository archives (zip/tar.gz) of private repositories the token owner has access to.

Impact

Scope escalation: tokens scoped to non-repository categories can access full repository content through the archive download endpoint. Higher impact than endpoints fixed in #37698 because /archive/* serves the entire repository.

Steps to Reproduce

Create a personal access token with ONLY read:misc scope
Access: GET /{owner}/{private-repo}/archive/main.tar.gz
Archive is served (200 OK) instead of being rejected (403 Forbidden)

Compare with fixed endpoints: - GET /{owner}/{private-repo}/raw/branch/main/README.md correctly returns 403

Root Cause

Download function in routers/web/repo/repo.go:372 does not call checkDownloadTokenScope. The outer group middleware reqUnitCodeReader checks repository permission but not token scope.

The API equivalent (/api/v1/repos/{owner}/{repo}/archive/*) IS properly scoped via tokenRequiresScopes(AccessTokenScopeCategoryRepository). The git HTTP endpoints are scoped via CheckRepoScopedToken in httpBase.

Suggested Fix

Add checkDownloadTokenScope(ctx) to Download and InitiateDownload in routers/web/repo/repo.go. The function already exists in routers/web/repo/download.go (same package).

Discovery Method

Variant analysis of PR #37698 — reviewed all web routes with webAuth.AllowOAuth2 middleware.

Severity ?

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.26.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "code.gitea.io/gitea"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-20706"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-16T23:42:04Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nPR #37698 added checkDownloadTokenScope to /raw/*, /media/*, and attachment download web endpoints. The /archive/* endpoint (repo.Download in routers/web/repo/repo.go:372) was not included in the fix. This endpoint accepts OAuth2 tokens via webAuth.AllowOAuth2 (registered at routers/web/web.go:1649-1652) but does not call checkDownloadTokenScope or CheckRepoScopedToken.\n\nA personal access token with any non-repository scope (e.g., read:issue or read:misc) can download full repository archives (zip/tar.gz) of private repositories the token owner has access to.\n\n## Impact\n\nScope escalation: tokens scoped to non-repository categories can access full repository content through the archive download endpoint. Higher impact than endpoints fixed in #37698 because /archive/* serves the entire repository.\n\n## Steps to Reproduce\n\n1. Create a personal access token with ONLY read:misc scope\n2. Access: GET /{owner}/{private-repo}/archive/main.tar.gz\n3. Archive is served (200 OK) instead of being rejected (403 Forbidden)\n\nCompare with fixed endpoints:\n- GET /{owner}/{private-repo}/raw/branch/main/README.md correctly returns 403\n\n## Root Cause\n\nDownload function in routers/web/repo/repo.go:372 does not call checkDownloadTokenScope. The outer group middleware reqUnitCodeReader checks repository permission but not token scope.\n\nThe API equivalent (/api/v1/repos/{owner}/{repo}/archive/*) IS properly scoped via tokenRequiresScopes(AccessTokenScopeCategoryRepository). The git HTTP endpoints are scoped via CheckRepoScopedToken in httpBase.\n\n## Suggested Fix\n\nAdd checkDownloadTokenScope(ctx) to Download and InitiateDownload in routers/web/repo/repo.go. The function already exists in routers/web/repo/download.go (same package).\n\n## Discovery Method\n\nVariant analysis of PR #37698 \u2014 reviewed all web routes with webAuth.AllowOAuth2 middleware.",
  "id": "GHSA-cr4g-f395-h25h",
  "modified": "2026-06-16T23:42:04Z",
  "published": "2026-06-16T23:42:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-cr4g-f395-h25h"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Gitea: Token scope bypass on web archive download endpoint"
}

FKIE_CVE-2026-20706

Vulnerability from fkie_nvd - Published: 2026-07-03 21:16 - Updated: 2026-07-03 21:16

Severity ?

Summary

Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.

References

	URL	Tags
	88ee5874-cf24-4952-aea0-31affedb7ff2	https://blog.gitea.com/release-of-1.26.2/
	88ee5874-cf24-4952-aea0-31affedb7ff2	https://github.com/go-gitea/gitea/pull/37735
	88ee5874-cf24-4952-aea0-31affedb7ff2	https://github.com/go-gitea/gitea/releases/tag/v1.26.2
	88ee5874-cf24-4952-aea0-31affedb7ff2	https://github.com/go-gitea/gitea/security/advisories/GHSA-cr4g-f395-h25h

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Gitea Open Source Git Server",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThanOrEqual": "1.26.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint."
    }
  ],
  "id": "CVE-2026-20706",
  "lastModified": "2026-07-03T21:16:56.433",
  "metrics": {},
  "published": "2026-07-03T21:16:56.433",
  "references": [
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "url": "https://blog.gitea.com/release-of-1.26.2/"
    },
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "url": "https://github.com/go-gitea/gitea/pull/37735"
    },
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.2"
    },
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-cr4g-f395-h25h"
    }
  ],
  "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-20706 (GCVE-0-2026-20706)

GHSA-CR4G-F395-H25H

Summary

Impact

Steps to Reproduce

Root Cause

Suggested Fix

Discovery Method

FKIE_CVE-2026-20706

Tags

Sightings

Nomenclature