CVE-2026-28699: Gitea OAuth2 Scope Bypass via HTTP Basic Auth (CVSS 8.1)

Technical summary

CVE-2026-28699 is an access control bypass vulnerability in Gitea ≤1.26.1 where OAuth2 token scope enforcement is circumvented via HTTP Basic authentication. The vulnerability stems from improper authorization validation (CWE-284: Improper Access Control to Resource by Wrong Sphere of Reference, CWE-863: Incorrect Authorization) in the authentication flow. When a request is authenticated using HTTP Basic credentials rather than an OAuth2 bearer token, the application fails to validate and enforce the scoped permissions defined in the OAuth2 token policy. This allows authenticated users to escalate their effective privileges beyond the intended grant scope, potentially reading or modifying repository data, user accounts, and other resources restricted by the OAuth2 policy.

Business impact

For organizations running Gitea as their Git hosting infrastructure, this vulnerability creates a significant privilege escalation risk. An attacker or insider with valid Gitea credentials can bypass OAuth2 restrictions designed to limit application permissions, enabling unauthorized access to source code, intellectual property, configuration secrets, and repository metadata. In supply-chain scenarios, compromised OAuth2 credentials for CI/CD integrations become ineffective as a containment boundary—an attacker can use HTTP Basic auth to extract more sensitive data than intended. Remediation requires urgent patching and potential credential rotation for all OAuth2 integrations.

Affected systems

All Gitea installations running version 1.26.1 or earlier are affected. Organizations should verify their Gitea deployment version and assess the scope of OAuth2 integrations (e.g., third-party CI/CD tools, API clients, web hooks) that may be exploited via this bypass.

Exploitability

Exploitability is high and requires only network access and valid user credentials. The attack is unauthenticated in the sense that it requires no zero-day capability or special tooling—any HTTP client can craft a Basic authentication header. However, it does require either a valid user credential or a compromised account. The low attack complexity (AC:L) and low privilege requirements (PR:L) mean that even a low-privileged or guest account in Gitea could be leveraged to bypass OAuth2 scopes. No user interaction is required.

Remediation

Upgrade Gitea to a patched version that enforces OAuth2 scope restrictions uniformly across all authentication methods. Contact the Gitea project to identify the fixed version number and apply it to all instances. Additionally, rotate credentials for any OAuth2 applications or API tokens that may have been exposed, and audit recent access logs for unauthorized activity. Implement network-level restrictions if possible to limit HTTP Basic authentication to trusted internal networks only.

Patch guidance

Verify the latest security advisory from the Gitea project for the patched version number and release date. Apply the patch immediately to all production and staging Gitea instances. Test the fix in a non-production environment to ensure compatibility with existing OAuth2 integrations and CI/CD pipelines before rolling out to production. Document the patching timeline and confirm that scope enforcement is now working as expected.

Detection guidance

Monitor Gitea access logs for HTTP Basic authentication requests paired with API calls or repository operations that exceed the OAuth2 scope policy of the user account. Look for patterns where a service account or low-privileged user makes requests that should be restricted to higher-scoped applications. Check audit logs for unauthorized repository modifications, user account changes, or secret access. Implement alerting on HTTP Basic auth usage in combination with sensitive API operations such as user creation, permission changes, or repository deletion.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.1) driven by high confidentiality and integrity impact. While it requires authentication, it enables scope bypass that could result in unauthorized access to critical source code and secrets. For organizations relying on OAuth2 scopes as a security boundary between applications and Gitea, this is a direct compromise of that control. The low complexity and low privilege requirements make it practical for attackers to exploit rapidly after gaining initial access.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects high impact in confidentiality (C:H) and integrity (I:H) with no availability impact (A:N). Network-based attack vector (AV:N) and low complexity (AC:L) indicate ease of exploitation, but the requirement for low privilege (PR:L) and no user interaction (UI:N) are the limiting factors preventing a critical rating. The bounded scope (S:U) means the impact is contained to the affected Gitea system rather than lateral movement. This score is appropriate for an authenticated privilege escalation flaw with clear remediation.

Frequently asked questions