CVE-2026-119441
Severity not reported`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route o…
`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently delete the organization's private repositories, which such a token must not reach. Routes that require organization ownership now reject public-only tokens.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://blog.gitea.com/release-of-28.3.0/ 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/pull/39690 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/pull/39853 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/releases/tag/v28.3.0 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/security/advisories/GHSA-jh8p-x4ch-389q 88ee5874-cf24-4952-aea0-31affedb7ff2