CVE-2026-20706 is an access control vulnerability in Gitea Open Source Git Server affecting versions prior to 1.26.2. The flaw allows bypassing token scope checks on the web archive download endpoint, enabling unauthorized repository archive downloads. This improper access control issue (CWE-284) can lead to exposure of repository contents without authentication or authorization. The CVSS 3.1 base score is 9.1, indicating critical impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts.

Successful exploitation allows an attacker to download repository archives without valid token scopes, potentially exposing sensitive source code or data. This compromises confidentiality and integrity of the affected repositories. There is no indication of availability impact. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor Gitea's official channels for updates. Until a patch is available, restrict access to the web archive download endpoint and enforce strict token scope validation through other means if possible.