Gitea Access Token Scope Mismanagement Vulnerability

A vulnerability exists in Gitea versions prior to 1.22.3, where the application improperly handles access to private resources when an API token is provided with a scope restricted to public resources. This flaw can lead to unauthorized access to private data.

Impact

Exploitation of this vulnerability could result in unauthorized access to private resources, bypassing the intended restrictions of the API token's scope.

Remediation

Users can upgrade to Gitea version 1.22.3, which addresses this vulnerability. Instructions for downloading this version are available on the Gitea releases page.