Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-101023 Details

Description

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://blog.gitea.com/release-of-28.1.0/	Gitea Limited
https://github.com/go-gitea/gitea/pull/39501	Gitea Limited
https://github.com/go-gitea/gitea/pull/39507	Gitea Limited
https://github.com/go-gitea/gitea/releases/tag/v28.1.0	Gitea Limited
https://github.com/go-gitea/gitea/security/advisories/GHSA-469m-x4mw-38r3	Gitea Limited

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes