CVE-2026-28744: Gitea Auth Bypass Vulnerability

CVE-2026-28744 Overview

CVE-2026-28744 is an authorization vulnerability in Gitea versions up to and including 1.26.1. The flaw allows Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks. An attacker holding a bearer token with restricted scope can perform Git operations against repositories outside the token's authorized scope. The weakness is classified under CWE-863: Incorrect Authorization. Gitea addressed the issue in version 1.26.2.

Critical Impact
Bearer token holders can bypass repository scope restrictions to read and modify repositories beyond their intended authorization boundary, undermining Gitea's token-based access control model.

Affected Products

Gitea versions up to and including 1.26.1
Self-hosted Gitea instances using bearer token authentication for Git smart HTTP
Gitea deployments relying on scoped repository tokens for access segmentation

Discovery Timeline

2026-07-03 - CVE-2026-28744 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-28744

Vulnerability Analysis

Gitea supports scoped access tokens that restrict what repositories and operations a token can perform. The Git smart HTTP endpoint handles git clone, git fetch, and git push operations over HTTPS. When a request authenticates with a bearer token, the authorization layer must verify that the token's scope covers the target repository.

In affected versions, the Git smart HTTP handler does not consistently enforce the repository scope claim on bearer tokens. Authentication succeeds and the token is accepted as valid, but the subsequent scope validation step does not correctly compare the requested repository against the token's authorized repository list. This mismatch between authentication and authorization is the classic pattern described in CWE-863.

Root Cause

The fix, delivered in Gitea Pull Request #37583, adds the missing scope enforcement path for Git smart HTTP requests. The root cause is a gap between the API scope-checking middleware and the Git protocol handler, which processed bearer tokens without applying the same scope filter used elsewhere in the codebase.

Attack Vector

An attacker requires a valid Gitea bearer token, such as one issued for a specific repository or a limited application integration. Using standard Git tooling, the attacker points a clone or push operation at a repository outside the token's declared scope while presenting the token in the Authorization: Bearer header. Because the smart HTTP path skips full scope validation, Gitea authorizes the operation. This enables lateral access to source code and, where the token carries write permissions, unauthorized commits to repositories the token was never intended to reach.

The vulnerability requires network reachability to the Gitea instance and a low-privileged authenticated token. No user interaction is required. Details are described in GitHub Security Advisory GHSA-cc8w-r4qh-3v65.

Detection Methods for CVE-2026-28744

Indicators of Compromise

Git smart HTTP requests to /{owner}/{repo}.git/info/refs, /git-upload-pack, or /git-receive-pack authenticated with bearer tokens whose scope does not include {owner}/{repo}
Unexpected git clone or git push activity from service account tokens against repositories they have never previously accessed
Access log entries showing HTTP 200 responses for Git operations on repositories outside a token's issued scope

Detection Strategies

Correlate Gitea access logs with the token scope registry to flag Git operations where the target repository is not in the token's allowed list
Alert on first-time repository access by long-lived bearer tokens, especially tokens tied to CI/CD or bot accounts
Baseline normal repository access patterns per token and detect deviations in destination repository or operation type

Monitoring Recommendations

Enable verbose Gitea request logging and forward logs to a centralized SIEM for retention and query
Track repository read and write volumes per token and alert on statistical spikes
Audit the token inventory and revoke unused or overly broad tokens on a scheduled cadence

How to Mitigate CVE-2026-28744

Immediate Actions Required

Upgrade all Gitea instances to version 1.26.2 or later, as documented in the Gitea 1.26.2 release announcement
Rotate bearer tokens that were issued with repository-scoped restrictions, since prior use cannot be retroactively constrained
Review Git access logs for the period preceding the patch to identify potentially abusive cross-scope requests

Patch Information

Gitea fixed CVE-2026-28744 in version 1.26.2. The fix is included in Pull Request #37583, which enforces repository scope checks on the Git smart HTTP path when authenticating with bearer tokens. Administrators running self-hosted Gitea should apply this update or a later release.

Workarounds

Where immediate upgrade is not possible, disable bearer token authentication for Git smart HTTP and require SSH key authentication or username-and-password Basic authentication with unscoped credentials removed
Restrict network access to the Gitea instance to trusted CI/CD networks until the patch is applied
Reduce the blast radius by issuing tokens with the minimum necessary permissions and short expiration windows

bash

# Verify the running Gitea version and confirm it is patched
gitea --version

# Example: revoke a bearer token via the Gitea API after upgrade
curl -X DELETE \
  -H "Authorization: token ${ADMIN_TOKEN}" \
  "https://gitea.example.com/api/v1/users/${USERNAME}/tokens/${TOKEN_ID}"