CVE-2026-117685
Gitea public-only package token access to private OCI blobs
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but checked the source blob only against the full account permissions of the token owner. A `public-only` token with `write:package` scope, whose owner can read a private package and write to a public package namespace, could mount a blob of the private package into the public package. The private blob, such as a container layer, could then be downloaded by anyone through the public package.
| CWE | CWE-863 |
| Vendor | gitea |
| Product | gitea |
| Published | Nov 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for gitea gitea
Be the first to know when new unknown vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Gitea / Gitea
0 < 28.3.0
References
github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-8g99-g36h-5p2w github.com: https://github.com/go-gitea/gitea/pull/39690 github.com: https://github.com/go-gitea/gitea/pull/39853 blog.gitea.com: https://blog.gitea.com/release-of-28.3.0/ github.com: https://github.com/go-gitea/gitea/releases/tag/v28.3.0
Credits
🔍 https://github.com/ohxorud-dev https://github.com/silverwind https://github.com/wxiaoguang https://github.com/lunny https://github.com/bircni