CVE-2026-28699

Published Jul 3, 2026·Updated Jul 6, 2026

NVD Description

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

[POC] CVE-2026-28699 — gitea-CVE-2026-28699

Lab + writeup for CVE-2026-28699: Gitea OAuth2 scope enforcement bypass via HTTP Basic auth

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Get alerted for CVEs like this