Executive brief
Gitea, a popular self-hosted Git service, contains a vulnerability where security restrictions on third-party application tokens can be ignored. An attacker or a malicious application with limited 'read-only' access could bypass these restrictions by using a specific login method (HTTP Basic authentication). This allows them to perform unauthorized actions such as modifying user profiles, creating or deleting repositories, and changing account settings.
Technical details
A vulnerability in Gitea's authentication logic allows OAuth2 access tokens to bypass scope enforcement when provided via HTTP Basic authentication (e.g., using the token as a username with 'x-oauth-basic'). The root cause is located in 'services/auth/basic.go', which fails to populate the 'ApiTokenScope' in the request context when a token is validated through the Basic auth path. Consequently, the scope enforcement middleware in 'routers/api/v1/api.go' exits early because it assumes no scope restrictions exist if the scope data is missing. This allows a token with minimal scopes (like 'read:user') to perform high-privilege write operations. The issue is fixed in version 1.26.2.
Affected products
- Gitea Gitea Open Source Git Server <= 1.26.1
Timeline
- 2026-05-01: other: Fix pull request submitted
- 2026-05-20: patched: Gitea version 1.26.2 released
- 2026-06-05: advisory: GitHub Security Advisory published
- 2026-07-03: disclosed: CVE published to NVD