CVE-2026-28744CWE-863

Gitea Git smart HTTP bypasses repository token scopes for bearer tokens

High · published July 3, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00448 · 38.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea Git smart HTTP bypasses repository token scopes for bearer tokens
    cvelistv5