CVE-2026-28744: Gitea Bearer Token Scope Bypass in Git Smart HTTP

Technical summary

CVE-2026-28744 stems from insufficient authorization enforcement in Gitea's Git smart HTTP request handler when processing bearer token authentication. The vulnerability allows an authenticated principal to circumvent repository-level token scope restrictions, effectively escalating privileges within the scope of bearer token operations. The flaw resides in the request path where Git smart HTTP operations (fetch, push, etc.) are processed; the server fails to re-validate token scope boundaries before granting access. The affected versions (≤1.26.1) do not properly enforce CWE-863 (Incorrect Authorization) constraints during these operations. Bearer tokens with restricted scopes—commonly used for CI/CD pipelines, API integrations, or third-party tooling—become equivalent to unrestricted tokens in the context of smart HTTP Git operations.

Business impact

Organizations running self-hosted Gitea instances face credential abuse risk. An insider or compromised service account with a narrowly-scoped token (e.g., a CI/CD bot token limited to a single repository) can exfiltrate code, inject malicious commits, or modify sensitive repositories across the Gitea instance. This undermines separation of duties and compliance controls that rely on token scoping for access isolation. For development teams, this may lead to unauthorized code disclosure, supply chain contamination, or inadvertent exposure of credentials embedded in repositories. Remediation delays increase window of exposure, especially in multi-tenant or regulated environments where scope enforcement is a security boundary.

Affected systems

Gitea versions 1.26.1 and all earlier releases are affected. The vulnerability is specific to Git smart HTTP protocol handling and does not affect SSH-based Git operations or web UI authentication. Organizations should audit all Gitea deployments to determine version and assess whether scoped bearer tokens are in use for Git operations (including automated CI/CD pipelines, API-driven integrations, or service account authentication).

Exploitability

Exploitation requires valid authentication credentials and knowledge of a target repository outside the token's intended scope. The attack is trivial once authenticated—a user simply directs a Git client to access an out-of-scope repository using the scoped bearer token via smart HTTP. No user interaction or complex exploitation technique is required; standard Git operations trigger the vulnerability. The barrier to exploitation is low because bearer token scope bypass is a direct consequence of the authorization flaw, not a race condition or timing issue. The CVSS 3.1 score of 8.1 (HIGH) reflects high impact (confidentiality and integrity both affected), low complexity, and the requirement for prior authentication.

Remediation

Upgrade Gitea to a patched version that properly enforces token scope boundaries during Git smart HTTP operations. Verify against the official Gitea release notes and security advisories for the specific patched version addressing CVE-2026-28744. As an interim measure, restrict Git smart HTTP access to trusted networks or require additional authentication layers (reverse proxy, VPN); however, this is not a substitute for patching. Review audit logs for unauthorized Git operations using bearer tokens and rotate any potentially compromised service account tokens. Disable scoped token usage for Git smart HTTP if possible until patches are applied, reverting to full-access tokens only as a temporary operational workaround.

Patch guidance

Apply the latest Gitea security update that resolves CVE-2026-28744. Consult the official Gitea GitHub repository and security advisories (gitea.io/security) for the minimum patched version. Test patches in a staging environment to ensure compatibility with existing Git workflows and CI/CD integrations before production deployment. After patching, validate that scoped tokens once again enforce repository-level access restrictions by testing Git operations against repositories outside the token's scope—these should now fail with authorization errors.

Detection guidance

Monitor Git smart HTTP request logs for bearer token authentication attempts followed by access to repositories outside the token's documented scope. Flag instances where a service account or CI/CD token accesses repositories it should not be authorized for. Check for unexpected pushes, fetches, or administrative operations from bearer-token-authenticated sessions. Review audit logs in Gitea's database or configured logging backends for authorization bypass patterns. Correlate Git operation logs with token scope definitions to identify mismatches. Implement alerting for out-of-scope Git operations by authenticated users, particularly for writes or sensitive reads.

Why prioritize this

This vulnerability earns HIGH priority because it directly breaks the security model of scoped credentials—a fundamental practice in DevOps and automation security. The flaw allows authenticated insiders or compromised automation tokens to escalate within a Gitea instance with minimal effort. For organizations using scoped tokens as a compensating control for least-privilege access, this is a critical gap. Combined with the ease of exploitation and the potential for code exfiltration or tampering, patching should be scheduled urgently. Organizations without scoped token usage face lower immediate risk but should still patch promptly given the fundamental nature of the flaw.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: (1) Network attack vector—Git smart HTTP is accessible over the network; (2) Low attack complexity—no special conditions required, standard Git operations trigger it; (3) Low privilege requirement—an authenticated user can exploit it (bearer token auth already in place); (4) No user interaction needed; (5) Impact is scoped to the affected Gitea instance (not system-wide); and (6) High confidentiality and integrity impact (unauthorized read and write access to out-of-scope repositories), with no availability impact. The score appropriately penalizes the ease of exploitation and dual confidentiality/integrity breach, warranting urgent remediation in production environments.

Frequently asked questions