{"items":[{"id":"NVI-00016330","kind":"vulnerability","title":"Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6cqf-375w-639g","CVE-2026-50105"],"plain_summary":"GitHub lists this reviewed advisory for code.gitea.io/gitea. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-685fd6acb2be50febd1ed5c6b1212de2"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-21T20:40:26.000Z","value":"4.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-685fd6acb2be50febd1ed5c6b1212de2"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-685fd6acb2be50febd1ed5c6b1212de2","url":"https://github.com/advisories/GHSA-6cqf-375w-639g","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-6cqf-375w-639g","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T22:34:39.734Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-685fd6acb2be50febd1ed5c6b1212de2"],"technology":"code.gitea.io/gitea","known_exclusions":[],"conditions_summary":"### Summary\n\nGitea's RSS/Atom feed handlers accept API-token Basic auth but perform **no token-scope or\npublic-only enforcement**. A personal access token that is correctly blocked (HTTP 403) from a\nprivate repository on `/raw`, `/media`, `/archive`, and `/releases/download/...` — because it is\nmarked *public-only* or lacks the `repository` scope category — still returns that repository's\nprivate content through the feed routes. This is a token-confinement bypass and appears to be an\nincomplete fix of #37698, which added that scope enforcement to the download handlers but not to the\nsibling feed handlers.\n\nThis is **not** a cross-user access bug: the requesting account must still legitimately have repo\nread access (`RepoAssignment` + `reqUnitCodeReader` are enforced). What is bypassed is the guarantee\nthat a *confined* token cannot reach private content — which is exactly the property #37698 was\nshipped to provide for downloads, and which matters when such a token is handed to a third-party\nservice/CI, leaked, or used in a lower-trust integration.\n\n### Details\n\n#37698 added `context.CheckTokenScopes` / `CheckRepoScopedToken`\n(`services/context/permission.go`) to the raw / media / a","public_affected_ranges":["< 1.27.0"]}],"null_published_at":"2026-11-04T10:04:27.932Z","source_updated_at":"2026-07-21T20:40:26.000Z","source_disclosed_at":"2026-07-21T20:40:24.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T22:34:39.734Z"}],"next_cursor":null,"snapshot_revision":"42594"}