Is CVE-2026-56654 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56654 being exploited in the wild.

How severe is CVE-2026-56654?

High severity, with a CVSS score of 4, published 21 July 2026.

Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Is there a fix for CVE-2026-56654?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56654 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-56654?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56654: Gitea privilege escalation via access token scope escalation in API

Q: Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Q: Is there a fix for CVE-2026-56654?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-56654 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-56654?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56654 · Severity: high · CVSS 4 · Published 2026-07-21

Gitea is an open-source platform for hosting software development projects. A security flaw in its programming interface (API) allows an attacker who has a limited-access token (such as one used for automated testing) to create a new, fully-privileged token. This allows the attacker to gain complete control over a user's account and data without needing to know their password.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-56654 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56654 being exploited in the wild.
How severe is CVE-2026-56654?: High severity, with a CVSS score of 4, published 21 July 2026.
Which products and versions are affected?: Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-56654?: Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56654 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56654?: Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.27.0 or later
```
go get code.gitea.io/gitea@v1.27.0
```
gitea.dev (Go): upgrade to 1.27.0 or later
```
go get gitea.dev@v1.27.0
```

Technical details

A privilege escalation vulnerability exists in Gitea's API due to a logic error in the authentication middleware. The `reqBasicOrRevProxyAuth` middleware, intended to require password-based authentication for sensitive operations like token creation, can be bypassed by providing a Personal Access Token (PAT) in the `Authorization: Basic <token>:x-oauth-basic` format. The backend incorrectly sets `IsBasicAuth=true` for these requests. Furthermore, the `CreateAccessToken` handler fails to implement a 'scope ceiling' check, allowing a caller with a restricted token to mint a new token with the 'all' scope. This allows an attacker with any valid token to escalate to full account privileges. Fixed in version 1.27.0.

Affected products

Gitea Gitea < 1.27.0

Identifiers

CVE-2026-56654
GHSA-683j-3ff6-hh2x
GO-2026-6034

Timeline

2026-07-13: disclosed
2026-07-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.