Description

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

Related CPE's

Could not find any relations

References

https://blog.gitea.com/release-of-1.26.2/

https://github.com/go-gitea/gitea/pull/37583

https://github.com/go-gitea/gitea/releases/tag/v1.26.2

https://github.com/go-gitea/gitea/security/advisories/GHSA-cc8w-r4qh-3v65

https://github.com/go-gitea/gitea/security/advisories/GHSA-cc8w-r4qh-3v65

Weaknesses

88ee5874-cf24-4952-aea0-31affedb7ff2

Secondary
CWE-863

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

8.1 · High

Information

Source identifier

88ee5874-cf24-4952-aea0-31affedb7ff2

Vulnerability status

Deferred

Published

2026-07-03T21:17:00.003Z

3 months ago

Last modified

2026-07-06T18:17:26.860Z

3 months ago