Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
mitre·CWE-441·Published 2025-12-26