CVE-2026-28699 - Gitea Basic Auth bypasses OAuth2 access token scopes

HIGH

Gitea Basic Auth bypasses OAuth2 access token scopes

Published Jul 3, 2026

8.1

HIGH

CVSS 3.1

EPSS 0.55%

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
0	affected	<=1.26.1

Ecosystem	Package	Introduced	Fixed
Go	code.gitea.io/gitea	0	1.26.2

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-863

Incorrect Authorization

Link	Providers	Tags
https://blog.gitea.com/release-of-1.26.2/		release-notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41640		Advisory
https://github.com/advisories/GHSA-9r5x-wg6m-x2rc		Advisory
https://github.com/go-gitea/gitea/pull/37503		patch
https://github.com/go-gitea/gitea/releases/tag/v1.26.2		release-notes
https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc		exploitvendor-advisory