Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.Referenceshttps://blog.gitea.com/release-of-1.22.3/https://github.com/go-gitea/gitea/releases/tag/v1.22.3https://github.com/go-gitea/gitea/pull/32218
