A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site administrator's token this applied to every account. Tokens are now accepted on this route only for feeds, which require `read:user` or `read:organization`.
A missing authorization vulnerability in Gitea prior to version 28.3.0 allowed repository and organization project boards to expose metadata of private pull requests referencing issues on public boards. This exposure included the private repository's path and pull request number, title, and state to anonymous viewers, though the pull request body, diff, and files were not disclosed. The issue was fixed in version 28.3.0 by skipping linked pull requests in repositories where the viewer lacks read permissions.
CVE-2026-119441 is an authorization vulnerability in Gitea affecting versions from 1.27.0 up to but not including 28.3.0. The DELETE API endpoint for deleting all repositories of an organization did not properly enforce restrictions on public-only access tokens. This allowed a public-only token belonging to an owner of a public organization to delete private repositories within that organization, which should have been inaccessible with such a token. The issue has been fixed in version 28.3.0 by rejecting public-only tokens on routes requiring organization ownership.
Gitea versions prior to 28.3.0 allowed users with permission to modify issues on archived repositories via the REST API, bypassing the web interface restriction that prevents changes on archived repositories. This could lead to unauthorized edits, closures, deletions, label changes, time tracking modifications, reactions, issue block changes, and pinning of issues in archived repositories. The issue was fixed in version 28.3.0 by applying the archived repository check to all modifying API requests.
Gitea versions prior to 28.3.0 contain a vulnerability where personal access tokens restricted to public resources ('public-only') can bypass intended restrictions and create private repositories and organizations. This occurs because certain API endpoints still accept these tokens for creating private repositories and organizations, despite the tokens being limited to public resource access. The tokens cannot read the private repositories they create. The issue was fixed in version 28.3.0.
CVE-2026-118394 is an information exposure vulnerability in Gitea's OAuth2 userinfo endpoint. The flaw caused the endpoint to incorrectly determine the scope of OAuth2 tokens, leading to unauthorized disclosure of private organization and team membership information of the token owner. No repository content was exposed. The issue is fixed in Gitea version 28.3.0.
CVE-2026-117685 is an authorization vulnerability in Gitea's OCI registry cross-repository blob mount feature. It allows a public-only token with write:package scope, whose owner has read access to a private package and write access to a public package namespace, to mount a private package blob into a public package. This misauthorization enables anyone to download the private blob via the public package.
CVE-2026-117677 is an uncontrolled resource consumption vulnerability in Gitea versions before 28.3.0. It occurs when parsing uploaded Helm charts, where the decompressed archive size is not limited before quota checks, allowing attackers with package write access to cause high CPU usage by uploading small, highly compressed archives. This can degrade the availability of the Gitea instance but does not enable code execution or unauthorized data access.
A vulnerability in Gitea before version 28.3.0 allows unauthorized users to access sensitive information from linked issues in private repositories. Specifically, dependency added and removed events expose details such as the linked issue's title, body, state, labels, poster, and attachment names through the API and web interface, even if the linked issue is in a repository the user cannot access. This exposure does not include comments or attachment downloads. The issue has been fixed in version 28.3.0.
A vulnerability in Gitea versions prior to 28.3.0 allowed personal access tokens restricted to public resources to list private repositories on user profiles and organization pages. This flaw exposed repository names and metadata but did not disclose repository content. The issue was fixed in version 28.3.0.
CVE-2026-117635 is an improper access control vulnerability in Gitea affecting versions prior to 28.3.0. The issue arises because the /api/v1/admin route group did not enforce the 'public-only' restriction on personal access tokens. This allowed a public-only token with admin scope, issued by a site administrator, to perform unauthorized actions such as listing private organizations and user email addresses, creating organizations, obtaining runner registration tokens, and creating new site administrator accounts. Notably, the created admin accounts persist even after the token is revoked. Tokens from non-administrator users cannot access these routes. The vulnerability is fixed in version 28.3.0, where public-only tokens are rejected on the admin API.
A vulnerability in Gitea Actions allows a workflow job authenticated as the system user 'gitea-actions' to register an email address and GPG key without email confirmation, causing commits signed with that key to appear as trusted and signed by the instance. This affects signature display status but does not grant access or bypass enforcement of signed commits. The issue is fixed in version 28.3.0.
A missing authorization vulnerability in Gitea prior to version 28.3.0 allowed users with write access to archived repositories to modify or delete release assets, releases, tags, milestones, and labels despite the repositories being intended as read-only. This issue has been fixed in version 28.3.0 by returning a 423 Locked status for such modification attempts on archived repositories.
Gitea versions prior to 28.3.0 contain an authorization flaw where personal access tokens restricted to public resources can be used to register organization-level runners that access private repository workflows, secrets, and variables. This vulnerability allows an attacker with a token having write:organization scope from a public organization owner to gain unintended access to private repository jobs. The issue is fixed in version 28.3.0.
A vulnerability in Gitea versions prior to 28.3.0 allowed exposure of contribution heatmap data derived from private repository activity to holders of public-only access tokens. While repository names and contents were not disclosed, unauthorized actors could view contribution counts and their 15-minute time buckets from private repositories. This issue has been fixed in version 28.3.0, where public-only tokens now restrict heatmap data to activity visible to anonymous users.
CVE-2026-113429 is a cross-site scripting (XSS) vulnerability in Gitea affecting legacy Actions artifact uploads (versions prior to 28.3.0). The vulnerability arises because the Content-Encoding header from artifact uploads was stored unchecked and used as the Content-Type when serving the artifact. If the Content-Type starts with video/ or audio/, it disables the sandboxing Content-Security-Policy, allowing an attacker to upload an artifact that a browser renders as HTML. This enables execution of attacker-controlled scripts in the context of the Gitea origin, potentially leading to session hijacking or full instance control if an administrator is targeted. The issue is fixed in version 28.3.0 by restricting stored headers and serve headers to valid media types only.
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with `GET /api/v1/user/repos` to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and `/api/v1/user` routes other than `GET /api/v1/user` accept only individual and bot accounts.
CVE-2026-120263 is an improper authentication vulnerability in Gitea versions before 28.3.0. When the OAuth2 client setting ACCOUNT_LINKING is set to auto and registration is enabled, the system incorrectly linked external OAuth2 identities to existing Gitea accounts based on submitted user names or emails rather than the identity asserted by the OAuth2 provider. This flaw allowed an attacker with an account on the OAuth2 provider to link their external identity to another user's Gitea account and sign in as that user without a password, including administrator accounts. The vulnerability was fixed in version 28.3.0 by restricting automatic linking to cases where the existing account matches the provider's email or provider-derived user name, otherwise requiring the account password.