Improper Restriction of Security Token Assignment Affecting gitea.dev/models/user package, versions <1.27.0-rc0
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITEADEVMODELSUSER-18172632
- published10 Aug 2026
- disclosed21 Jul 2026
- creditPcat2003
Introduced: 21 Jul 2026
NewCVE-2026-58429 Â (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade gitea.dev/models/user to version 1.27.0-rc0 or higher.
Overview
Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization details by sending requests to endpoints such as /api/v1/user/orgs and /api/v1/users/{username}/orgs/{org}/permissions using a public-only scoped token.