CVE-2026-28699 Overview
CVE-2026-28699 is an access control vulnerability in Gitea, a self-hosted Git service written in Go. The flaw affects Gitea versions up to and including 1.26.1 and allows OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication. An authenticated attacker can leverage this weakness to perform actions beyond the granted OAuth2 token scope, undermining least-privilege controls on API operations. The issue is categorized under CWE-284: Improper Access Control and resolved in Gitea 1.26.2.
Critical Impact
An attacker with low-privileged credentials can bypass OAuth2 scope restrictions and access or modify repository resources that should be blocked by scope-limited tokens.
Affected Products
- Gitea versions up to and including 1.26.1
- Gitea self-hosted Git service instances exposing the API over HTTP Basic authentication
- Fixed in Gitea 1.26.2
Discovery Timeline
- 2026-07-03 - CVE-2026-28699 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-28699
Vulnerability Analysis
Gitea supports two primary authentication paths for API requests: OAuth2 bearer tokens and HTTP Basic authentication. OAuth2 access tokens carry scope claims that restrict which API endpoints and operations the token may invoke. HTTP Basic authentication, by contrast, is intended for direct user credential validation and does not carry scope metadata.
In affected versions, when an OAuth2 access token is presented as the password field of an HTTP Basic authentication header, Gitea authenticates the request but fails to enforce the token's declared scope. The request is treated as if the underlying user had performed a full-privilege login, effectively promoting a scope-limited token to the user's full authorization set.
This creates a scope escalation primitive. A read-only token can be used to perform write operations, and administrative endpoints restricted by scope become reachable if the associated user holds those permissions.
Root Cause
The root cause lies in the authentication middleware path that handles HTTP Basic credentials. The scope evaluation logic applied to bearer-token requests is not invoked when the same token is supplied via Basic auth, resulting in inconsistent enforcement of authorization state across authentication mechanisms. The fix landed in Gitea Pull Request #37503.
Attack Vector
Exploitation requires network access to a Gitea instance and possession of a valid OAuth2 access token or the credentials required to obtain one. The attacker submits API requests using HTTP Basic authentication, supplying the username and the scoped OAuth2 token as the password. Gitea processes the request without applying scope restrictions, granting the attacker the full permission set of the underlying account. See the GitHub Security Advisory GHSA-9r5x-wg6m-x2rc for advisory details.
No verified public exploit code is available at the time of publication. Refer to the Gitea Release Announcement for vendor guidance.
Detection Methods for CVE-2026-28699
Indicators of Compromise
- API requests using HTTP Basic authentication where the password field contains an OAuth2 access token format rather than a user password.
- Successful write or administrative API calls performed by tokens that were provisioned with read-only or restricted scopes.
- Sudden increase in Basic authentication traffic to /api/v1/ endpoints from clients that previously used bearer tokens.
Detection Strategies
- Review Gitea access logs for Authorization: Basic headers targeting API endpoints and correlate them against expected token scope inventories.
- Compare actions performed by each token identifier against the scope granted at token creation to identify scope violations.
- Alert on API calls to sensitive endpoints such as repository administration, user management, and webhook creation when authenticated via Basic auth.
Monitoring Recommendations
- Enable verbose audit logging in Gitea and forward events to a centralized log analytics platform for scope-versus-action correlation.
- Baseline normal OAuth2 token usage patterns per user and application, and flag deviations in authentication method.
- Monitor for creation of new OAuth2 applications and tokens, particularly those with broad scope grants, following disclosure of this CVE.
How to Mitigate CVE-2026-28699
Immediate Actions Required
- Upgrade Gitea to version 1.26.2 or later, which contains the scope enforcement fix from Pull Request #37503.
- Audit existing OAuth2 access tokens and revoke any tokens that are not actively required or that carry broader scopes than necessary.
- Rotate credentials for any accounts suspected of exposure, especially administrative accounts with associated OAuth2 tokens.
Patch Information
Gitea released version 1.26.2 addressing this vulnerability. Download the fixed release from the Gitea Release Tag v1.26.2 page. Review the Gitea 1.26.2 Release Announcement for complete upgrade notes and additional security fixes.
Workarounds
- Restrict Gitea API access at the network layer to trusted CIDR ranges until the upgrade is applied.
- Disable HTTP Basic authentication for API endpoints where feasible, forcing clients to use bearer-token authentication paths that correctly enforce scope.
- Enforce short token lifetimes and minimum-necessary scope grants on all OAuth2 applications to reduce the blast radius of any bypass.
# Verify the running Gitea version and upgrade to the patched release
gitea --version
# On systemd-based hosts, replace the binary and restart the service
sudo systemctl stop gitea
sudo cp gitea-1.26.2-linux-amd64 /usr/local/bin/gitea
sudo chmod +x /usr/local/bin/gitea
sudo systemctl start gitea
sudo systemctl status gitea
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
