{"id":"GHSA-8629-vc8r-5p58","summary":"Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw","details":"## Summary\n\nTwo related issues in the token public-only scope enforcement introduced by PR #32204 (CVE-2025-68941 fix). A public-only scoped API token can access private organization data.\n\n## Issue 1: /user/orgs missing checkTokenPublicOnly()\n\n`routers/api/v1/api.go` line 1599:\n```go\nm.Get(\"/user/orgs\", reqToken(), tokenRequiresScopes(\n    auth_model.AccessTokenScopeCategoryUser,\n    auth_model.AccessTokenScopeCategoryOrganization,\n), org.ListMyOrgs)\n// Missing checkTokenPublicOnly()\n```\n\nAdjacent route at line 1603 has it:\n```go\nm.Group(\"/users/{username}/orgs\", func() { ... },\n    ..., checkTokenPublicOnly())\n```\n\n## Issue 2: checkTokenPublicOnly switch-case evaluates only first matching category\n\n`routers/api/v1/api.go` lines 253-295. Go switch executes only the first matching case. For routes with categories [User, Organization]:\n\n1. Organization case matches first (line 263)\n2. ctx.Org.Organization is nil on user routes, passes\n3. ctx.ContextUser.IsOrganization() is false, passes\n4. User case (line 273) is never reached\n5. User visibility check skipped entirely\n\n## Steps to Reproduce\n\n1. Create a token with public-only scope (Settings \u003e Applications \u003e check \"public only\")\n2. Call: `curl -H \"Authorization: token \u003cPUBLIC_ONLY_TOKEN\u003e\" https://gitea.example.com/api/v1/user/orgs`\n3. Response includes private and limited-visibility organizations\n\nExpected: only public organizations returned.\n\n## Impact\n\nPublic-only scoped tokens can enumerate private organizations the token owner belongs to. Violates the token's declared scope constraints.\n\n## Suggested Fix\n\n1. Add `checkTokenPublicOnly()` to `/user/orgs` route at line 1599\n2. Replace switch with loop over all categories so User visibility check is not skipped\n\n## Version\n\nCurrent main branch, commit 2c2d7e6 (April 3, 2026).","aliases":["CVE-2026-25714","GO-2026-5243"],"modified":"2026-06-25T19:56:27.569413261Z","published":"2026-06-16T23:41:31Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-06-16T23:41:31Z","nvd_published_at":null,"cwe_ids":["CWE-862"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8629-vc8r-5p58"},{"type":"PACKAGE","url":"https://github.com/go-gitea/gitea"}],"affected":[{"package":{"name":"code.gitea.io/gitea","ecosystem":"Go","purl":"pkg:golang/code.gitea.io/gitea"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.2"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 1.26.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-8629-vc8r-5p58/GHSA-8629-vc8r-5p58.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}