Gitea before version 1.27.0 has a security flaw (CVE-2026-58444) in which personal access tokens or OAuth2 tokens without the 'repository' scope can bypass token scope enforcement on the repository home page endpoint (GET /{owner}/{repo}). This bypass results in unauthorized disclosure of private repository metadata and content including rendered README files, file trees, repository descriptions, language statistics, license details, and latest release information. The vulnerability is due to missing scope checks on this route, while other repository content routes correctly enforce token scope restrictions.

An attacker with a personal access token or OAuth2 token lacking the 'repository' scope can access private repository information that should be restricted. The disclosed information includes repository metadata and content such as README files, file trees, descriptions, language statistics, licenses, and release information. This leads to confidentiality loss of private repository data but does not affect integrity or availability.

A patch is available that fixes this scope enforcement bypass in Gitea version 1.27.0. Users should upgrade to version 1.27.0 or later to remediate this vulnerability. Until patched, avoid using personal access tokens or OAuth2 tokens without the required 'repository' scope to access repository home pages. No other specific mitigations are indicated.