CVE-2026-56443

CriticalCVSS 9.6

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

A public-only scope token can bypass restrictions on limited-visibility owners (Repository and Package categories) — residual after CVE-2026-25714 / PR #37118.

Risk Assessment

Users with public-only tokens may gain access to data that should be hidden, compromising confidentiality.

Recommendation

Install the latest patch and test access scenarios with public-only tokens.

Original NVD description (English source)

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118