high8.1
CVE-2026-28699
Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.
Impact
Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | code.gitea.io/gitea | <= 1.26.1 | 1.26.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-9r5x-wg6m-x2rc
- https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc
- https://blog.gitea.com/release-of-1.26.2/
- https://github.com/go-gitea/gitea/pull/37503
- https://github.com/go-gitea/gitea/releases/tag/v1.26.2