{"id":"CVE-2026-25714","aliases":["GHSA-8629-vc8r-5p58","GO-2026-5243"],"url":"https://o3.security/vulnerability/CVE-2026-25714","summary":"Gitea user organization API bypasses public-only token filtering","details":"## Summary\n\nTwo related issues in the token public-only scope enforcement introduced by PR #32204 (CVE-2025-68941 fix). A public-only scoped API token can access private organization data.\n\n## Issue 1: /user/orgs missing checkTokenPublicOnly()\n\n`routers/api/v1/api.go` line 1599:\n```go\nm.Get(\"/user/orgs\", reqToken(), tokenRequiresScopes(\n    auth_model.AccessTokenScopeCategoryUser,\n    auth_model.AccessTokenScopeCategoryOrganization,\n), org.ListMyOrgs)\n// Missing checkTokenPublicOnly()\n```\n\nAdjacent route at line 1603 has it:\n```go\nm.Group(\"/users/{username}/orgs\", func() { ... },\n    ..., checkTokenPublicOnly())\n```\n\n## Issue 2: checkTokenPublicOnly switch-case evaluates only first matching category\n\n`routers/api/v1/api.go` lines 253-295. Go switch executes only the first matching case. For routes with categories [User, Organization]:\n\n1. Organization case matches first (line 263)\n2. ctx.Org.Organization is nil on user routes, passes\n3. ctx.ContextUser.IsOrganization() is false, passes\n4. User case (line 273) is never reached\n5. User visibility check skipped entirely\n\n## Steps to Reproduce\n\n1. Create a token with public-only scope (Settings > Applications > check \"public only\")\n2. Call: `curl -H \"Authorization: token <PUBLIC_ONLY_TOKEN>\" https://gitea.example.com/api/v1/user/orgs`\n3. Response includes private and limited-visibility organizations\n\nExpected: only public organizations returned.\n\n## Impact\n\nPublic-only scoped tokens can enumerate private organizations the token owner belongs to. Violates the token's declared scope constraints.\n\n## Suggested Fix\n\n1. Add `checkTokenPublicOnly()` to `/user/orgs` route at line 1599\n2. Replace switch with loop over all categories so User visibility check is not skipped\n\n## Version\n\nCurrent main branch, commit 2c2d7e6 (April 3, 2026).","published":"2026-07-03T20:19:32.756Z","modified":"2026-10-28T02:30:37.599439979Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"epss":{"score":0.00342,"percentile":0.26988,"asOf":"2026-09-01"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"code.gitea.io/gitea","fixedVersion":"1.26.2"}],"fix":{"url":"https://github.com/go-gitea/gitea/pull/37118","label":"go-gitea/gitea#37118"},"references":[{"type":"ADVISORY","url":"https://blog.gitea.com/release-of-1.26.2/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25714.json"},{"type":"ADVISORY","url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.2"},{"type":"ADVISORY","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8629-vc8r-5p58"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25714"},{"type":"FIX","url":"https://github.com/go-gitea/gitea/pull/37118"},{"type":"PACKAGE","url":"https://github.com/go-gitea/gitea"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:37.599439979Z"}}