Go/code.gitea.io/gitea CVE-2026-24791: unknown, EPSS 0.45%

Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes in code.gitea.io/gitea

Action: Upgrade code.gitea.io/gitea to 1.26.2 or later.

go get code.gitea.io/gitea@v1.26.2

Affected

Fixed versions

Sources

• osv: GO-2026-5721
• https://github.com/go-gitea/gitea/security/advisories/GHSA-wrr5-99h5-gq57

CVE-2026-24791 · published 2026-06-25T22:34:38Z · modified 2026-06-25T23:01:29.558137132Z · JSON