4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25714

CVE-2026-25714: Gitea user organization API bypasses public-only token filtering

Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25714

CVE-2026-25714:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.gitea.io/gitea	go	<= 1.26.1	1.26.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by two related issues in Gitea's API, allowing a public-only scoped token to access private organization data. First, the /api/v1/user/orgs endpoint was missing the checkTokenPublicOnly middleware in its route definition within the api.Routes function. This meant no public-only check was performed for that specific endpoint. Second, the api.checkTokenPublicOnly function itself contained a logical flaw. It used a switch statement that would only evaluate the first matching scope category for an endpoint, so if an endpoint had multiple categories (e.g., User and Organization), it would not check all of them, leading to incomplete validation. The handler for the endpoint, org.ListMyOrgs, also failed to filter results for public-only access. The fix involved adding the missing middleware to the route, correcting the logic in checkTokenPublicOnly to iterate through all scope categories, and ensuring the data retrieval in org.ListMyOrgs respects the public-only constraint.

Vulnerable functions

api.checkTokenPublicOnly

routers/api/v1/api.go

The function had a flawed switch-case logic that only evaluated the first matching token scope category for a route. This could cause other required visibility checks to be skipped, leading to information disclosure. For a route with both 'User' and 'Organization' scopes, it would only check the 'Organization' scope and never perform the 'User' visibility check.

api.Routes

routers/api/v1/api.go

This function defines the API routes. The route for `/user/orgs` was missing the `checkTokenPublicOnly` middleware. This allowed tokens with `public-only` scope to access this endpoint without the necessary visibility checks, leading to the disclosure of private organization information.

org.ListMyOrgs

routers/api/v1/org/org.go

This function handles the `/user/orgs` API request. It was vulnerable because it did not properly filter out private organizations for requests made with a public-only token. The fix involves applying a 'public only' filter to the database query options. This function is called by the route handler and is where the data leakage occurred.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.