CVE-2026-28699CWE-284CWE-863

Gitea Basic Auth bypasses OAuth2 access token scopes

High · published July 3, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00551 · 45.3th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-863 · Incorrect Authorization
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea Basic Auth bypasses OAuth2 access token scopes
    cvelistv5