{"id":"CVE-2026-25714","title":"Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw","summary":"Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw","severity":"medium","cvss":4.3,"cwe":["CWE-862"],"vendor":"gitea","product":"code.gitea.io/gitea","ecosystem":"go","affected":["code.gitea.io/gitea <= 1.26.1"],"patched":["code.gitea.io/gitea 1.26.2"],"published":"2026-06-16","updated":"2026-06-16","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-8629-vc8r-5p58","references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8629-vc8r-5p58"},{"url":"https://github.com/advisories/GHSA-8629-vc8r-5p58"}],"tags":["ghsa","go"],"ingestedAt":"2026-06-29T14:31:47.456Z","epss":0.00342,"epssPercentile":0.27738,"slug":"CVE-2026-25714","body":"## Overview\n\n## Summary\n\nTwo related issues in the token public-only scope enforcement introduced by PR #32204 (CVE-2025-68941 fix). A public-only scoped API token can access private organization data.\n\n## Issue 1: /user/orgs missing checkTokenPublicOnly()\n\n`routers/api/v1/api.go` line 1599:\n```go\nm.Get(\"/user/orgs\", reqToken(), tokenRequiresScopes(\n    auth_model.AccessTokenScopeCategoryUser,\n    auth_model.AccessTokenScopeCategoryOrganization,\n), org.ListMyOrgs)\n// Missing checkTokenPublicOnly()\n```\n\nAdjacent route at line 1603 has it:\n```go\nm.Group(\"/users/{username}/orgs\", func() { ... },\n    ..., checkTokenPublicOnly())\n```\n\n## Issue 2: checkTokenPublicOnly switch-case evaluates only first matching category\n\n`routers/api/v1/api.go` lines 253-295. Go switch executes only the first matching case. For routes with categories [User, Organization]:\n\n1. Organization case matches first (line 263)\n2. ctx.Org.Organization is nil on user routes, passes\n3. ctx.ContextUser.IsOrganization() is false, passes\n4. User case (line 273) is never reached\n5. User visibility check skipped entirely\n\n## Steps to Reproduce\n\n1. Create a token with public-only scope (Settings > Applications > check \"public only\")\n2. Call: `curl -H \"Authorization: token <PUBLIC_ONLY_TOKEN>\" https://gitea.example.com/api/v1/user/orgs`\n3. Response includes private and limited-visibility organizations\n\nExpected: only public organizations returned.\n\n## Impact\n\nPublic-only scoped tokens can enumerate private organizations the token owner belongs to. Violates the token's declared scope constraints.\n\n## Suggested Fix\n\n1. Add `checkTokenPublicOnly()` to `/user/orgs` route at line 1599\n2. Replace switch with loop over all categories so User visibility check is not skipped\n\n## Version\n\nCurrent main branch, commit 2c2d7e6 (April 3, 2026).\n\n## Affected packages\n\n- `code.gitea.io/gitea <= 1.26.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `code.gitea.io/gitea 1.26.2`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}