CVE-2026-28744
published 2026-07-03CVE-2026-28744: Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.
PriorityP348high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.34%
27.5th percentile
Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.26.2 | 1.26.2 |
| gitea | gitea_open_source_git_server | <= 1.26.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Gitea up to 1.26.1 HTTP Request authorization (GHSA-cc8w-r4qh-3v65)
vuldb·2026-07-04·CVSS 8.1
CVE-2026-28744 [HIGH] Gitea up to 1.26.1 HTTP Request authorization (GHSA-cc8w-r4qh-3v65)
A vulnerability described as critical has been identified in Gitea up to 1.26.1. Affected is an unknown function of the component HTTP Request Handler. Executing a manipulation can lead to incorrect authorization.
This vulnerability is handled as CVE-2026-28744. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
ghsa·2026-06-16
CVE-2026-28744 [HIGH] CWE-863 Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
### Summary
Gitea v1.26.1 enforces repository-scoped access-token permissions on repository operations. In the Git Smart HTTP path, however, this check runs only when the token is presented via HTTP Basic authentication — `CheckRepoScopedToken()` returns early unless `ctx.IsBasicAuth` is true — so the same token sent as `Authorization: Bearer ` bypasses the scope check entirely.
As a result, a PAT or OAuth2 token presented as a Bearer credential can clone or fetch private repositories without the `read:repository` scope, and likewise reach the Git push without `write:repository`.
### Details
Git Smart HTTP routes allow both Basic auth and OAuth2/Bearer auth:
```go
// routers/web/web.go
addOwnerRepoGitHTTPRouters(
m,
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-03
Published