Threats tagged 'ghsa-6cqf-375w-639g'

Gitea versions prior to 1.27.0 have a vulnerability in their RSS/Atom feed handlers where API tokens with restricted scopes or marked as public-only can still access private repository content via feed routes. This bypasses the intended token scope and public-only confinement enforced on other download handlers. The issue allows tokens that should be blocked from private repo data to retrieve commit details, release notes, and private activity streams through various feed endpoints.