Gitea before version 1.27.0 contains an access control vulnerability (CVE-2026-58431) where public-only API tokens, which should be limited to accessing only public repositories and organizations, can bypass restrictions on team API routes. This is due to the organization visibility check being bypassed because of missing organization context, and the absence of repository-level public-only filtering. As a result, private team repository metadata and private team activity feed entries can be retrieved using a public-only token. The vulnerability has been verified on version 1.26.2 and nightly builds. The CVSS 3.1 score is 4.3 (medium severity).

An attacker with a public-only API token can access private metadata and activity feeds of team repositories that should be restricted. This leads to unauthorized disclosure of private repository information, although it does not allow modification or denial of service. The impact is limited to confidentiality loss of private team repository metadata and activity feed entries.

A patch is available in Gitea version 1.27.0 that fixes this vulnerability by properly enforcing public-only API token restrictions on team API routes. Users should upgrade to version 1.27.0 or later to remediate this issue.