GO-2026-5299

vendorUSosv

Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication in code.gitea.io/gitea

view advisory published 2026-06-25Licence: per source

Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication in code.gitea.io/gitea

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-28699US	—OT elevated	0.55% (46th)	Exploit	2026-07-03
Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.