9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-20706

CVE-2026-20706: Gitea repository archive downloads bypass token scope checks

Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-20706

CVE-2026-20706:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.gitea.io/gitea	go	<= 1.26.1	1.26.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Gitea's web archive download functionality. The endpoints responsible for downloading repository archives, specifically /archive/*, did not properly validate the scope of the OAuth2 token being used for authentication. This allowed a user with a token that had any scope, even non-repository related ones like read:issue, to download the full archive of any private repository they had access to. The root cause was the absence of a token scope check in the Download and InitiateDownload functions located in routers/web/repo/repo.go. The vulnerability was fixed by adding a call to the checkDownloadTokenScope function at the beginning of both of these functions, ensuring that the token has the necessary repository scope before allowing the download to proceed. An exploit of this vulnerability would involve a call to either the Download or InitiateDownload function, which would appear in a runtime profile.

Vulnerable functions

Download

routers/web/repo/repo.go

The `Download` function in `routers/web/repo/repo.go` is responsible for handling repository archive downloads. Before the patch, this function did not perform a token scope check. This allowed an attacker with a valid, but not repository-scoped, token to download the entire archive of a private repository. The patch adds a call to `checkDownloadTokenScope` to ensure the token has the required permissions.

InitiateDownload

routers/web/repo/repo.go

The `InitiateDownload` function in `routers/web/repo/repo.go` is used to start the process of creating a repository archive for download. Similar to the `Download` function, it was missing a token scope check. This allowed an attacker to initiate the creation of an archive for a private repository without having the necessary token scope. The patch adds the `checkDownloadTokenScope` call to fix this vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.