CVE-2026-28699 Details
Description
Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.
A vulnerability in Gitea versions through 1.26.1 allows the OAuth2 access token scope enforcement to be bypassed when tokens are submitted via HTTP Basic authentication. This flaw enables applications to perform actions beyond their authorized permissions. For instance, an application with 'read:user' scope can use the token to modify user profiles, add email addresses, create repositories, and delete repositories on behalf of the user.
Users are advised to upgrade to Gitea version 1.26.2, which addresses this vulnerability by ensuring that OAuth2 tokens submitted via Basic authentication are properly scoped before being processed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 3, 2026CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://blog.gitea.com/release-of-1.26.2/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/37503 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.26.2 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc | Gitea Limited | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | Gitea Limited |
| CWE-863 | Incorrect Authorization | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 1.26.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | Gitea Limited |