Description
Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.
Related CPE's
Could not find any relations
References
Weaknesses
88ee5874-cf24-4952-aea0-31affedb7ff2
Secondary
CWE-284CWE-863
CVSS impact metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
8.1 · High
Information
Source identifier
88ee5874-cf24-4952-aea0-31affedb7ff2
Vulnerability status
Deferred
Published
2026-07-03T21:16:59.567Z
3 months agoLast modified
2026-07-06T18:17:26.860Z
3 months ago