{"id":"CVE-2026-119441","published":"2026-11-01T10:18:36.643","lastModified":"2026-11-01T10:18:36.750","description":"`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently delete the organization's private repositories, which such a token must not reach. Routes that require organization ownership now reject public-only tokens.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.3.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39690","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39853","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-jh8p-x4ch-389q","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/39690","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39853","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-jh8p-x4ch-389q","tags":[]}],"hasPoc":true,"ai":null}