CVE-2026-28699
published 2026-07-03CVE-2026-28699: Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.
PriorityP354high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.57%
44.6th percentile
Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.26.2 | 1.26.2 |
| gitea | gitea_open_source_git_server | <= 1.26.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Gitea up to 1.26.1 access control (GHSA-9r5x-wg6m-x2rc)
vuldb·2026-07-04·CVSS 8.1
CVE-2026-28699 [HIGH] Gitea up to 1.26.1 access control (GHSA-9r5x-wg6m-x2rc)
A vulnerability was found in Gitea up to 1.26.1. It has been classified as critical. This vulnerability affects unknown code. Performing a manipulation results in improper access controls.
This vulnerability is cataloged as CVE-2026-28699. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication
ghsa·2026-06-16
CVE-2026-28699 [HIGH] CWE-284 Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication
Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication
### Summary
Gitea fails to enforce OAuth2 access token scopes when the token is submitted via HTTP Basic authentication instead of a Bearer token. An OAuth2 application granted only `read:user` can use the same token as `Authorization: Basic base64(:x-oauth-basic)` and perform write actions, including modifying profiles, adding email addresses, creating repositories, and deleting repositories as the authorizing user.
### Details
**Root cause:** `services/auth/basic.go` accepts OAuth2 access tokens through the Basic auth path but does not store the token scope in the request context:
```go
// services/auth/basic.go
if uid != 0 {
store.GetData()["LoginMethod"] = OAuth2TokenMethodName
store.GetData()["IsApi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-03
Published