CVE-2026-56654
published 2026-08-13CVE-2026-56654: Privilege Escalation via Access Token Scope Escalation in API
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.41%
34.3th percentile
Privilege Escalation via Access Token Scope Escalation in API
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
| gitea | gitea_open_source_git_server | <= 1.26.4 | — |
| openshift-pipelines | pipelines-cli-tkn-rhel9 | — | — |
| openshift-pipelines | pipelines-opc-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-cli-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-controller-rhel9 | — | — |
| openshift-pipelines | pipelines-pipelines-as-code-watcher-rhel9 | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea: Privilege Escalation via Access Token Scope Escalation in API
ghsa·2026-07-21
CVE-2026-56654 [HIGH] CWE-287 Gitea: Privilege Escalation via Access Token Scope Escalation in API
Gitea: Privilege Escalation via Access Token Scope Escalation in API
Gitea's API endpoint for creating Personal Access Tokens (`POST /users/{username}/tokens`) is protected by a middleware (`reqBasicOrRevProxyAuth`) that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in the `Authorization: Basic :x-oauth-basic` format, the Basic auth handler validates it and sets `AuthedMethod="basic"`, causing `IsBasicAuth=true` and fooling the middleware into passing the request. Once past the guard, the token creation handler applies no scope ceiling — it will create a new token with any requested scope regardless of the caller's scope. An attacker with a restricted token (e.g. `write:user` from a le
Red Hat
code.gitea.io/gitea: Gitea: Privilege Escalation via API Access Token Scope Escalation
vendor_redhat·2026-08-13·CVSS 9.8
CVE-2026-56654 [CRITICAL] CWE-266 code.gitea.io/gitea: Gitea: Privilege Escalation via API Access Token Scope Escalation
code.gitea.io/gitea: Gitea: Privilege Escalation via API Access Token Scope Escalation
Privilege Escalation via Access Token Scope Escalation in API
A flaw was found in Gitea. This vulnerability allows an attacker to escalate their privileges by manipulating the scope of an access token within the API. This means an attacker could gain unauthorized access to sensitive functions or data, potentially leading to full control over affected resources.
Statement: Important: An authenticated attacker with a limited-scope API token in Gitea could escalate their privileges. This is due to a flaw in how Gitea's API processes basic authentication with tokens, allowing the creation of new tokens with elevated scopes beyond the original token's permissions. Red Hat OpenShift Pipelines does not deplo
No detection rules found.
No public exploits indexed.
2026-08-13
Published