https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 14:16:05 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-70406 <p>Gitea&#39;s shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head repository accessible to the token owner. This bypasses the token&#39;s public-only restriction; it does not remove the account&#39;s underlying repository permission checks.</p> <p>Gitea&#39;s shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head repository accessible to the token owner. This bypasses the token&#39;s public-only restriction; it does not remove the account&#39;s underlying repository permission checks.</p> https://db.gcve.eu/vuln/fkie_cve-2026-70406