BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Gitea

CVE-2026-119625: The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope,

CVE-2026-119625 Nov 1, 2026 Source: Vendor

The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site ad

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-119625
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

5 lines
All 5 CVEs 5 Additional recognition 0 Unclaimed only
No lines match. , clear filters
Nothing here matches those filters. Clear them to see all 5 lines.