EUVD-2026-333351

fkie_cve-2026-28744

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

GHSA-cc8w-r4qh-3v65 — Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens

Affected: Go: code.gitea.io/gitea

### Summary Gitea v1.26.1 enforces repository-scoped access-token permissions on repository operations. In the Git Smart HTTP path, however, this check runs only when the token is presented via HTTP Basic authentication — `CheckRepoScopedToken()` returns early unless `ctx.IsBasicAuth` is true — so the same token sent as `Authorization: Bearer <token>` bypasses the scope check entirely.

As a result, a PAT or OAuth2 token presented as a Bearer credential can clone or fetch private repositories without the `read:repository` scope, and likewise reach the Git push without `write:repository`.

### Details Git Smart HTTP routes allow both Basic auth and OAuth2/Bearer auth:

```go // routers/web/web.go addOwnerRepoGitHTTPRouters( m, repo.HTTPGitEnabledHandler, webAuth.AllowBasic, webAuth.AllowOAuth2, repo.CorsHandler(), optSignInFromAnyOrigin, context.UserAssignmentWeb(), ) ```

The Git HTTP authorization path calls `CheckRepoScopedToken()` before falling through to normal repository RBAC:

```go // routers/web/repo/githttp.go if askAuth { if !ctx.IsSigned { ctx.HTTPError(http.StatusUnauthorized) return nil }

context.CheckRepoScopedToken(ctx, repo, auth_model.GetScopeLevelFromAccessMode(accessMode)) if ctx.Written() { return nil }

// normal repository RBAC follows } ```

However, `CheckRepoScopedToken()` only enforces token scopes for Basic-authenticated requests:

```go // services/context/permission.go func CheckRepoScopedToken(ctx *Context, repo *repo_model.…

WID-SEC-W-2026-1637 — Gitea: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um möglicherweise erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren und offenzulegen.

Most recent entries from all

bdu:2026-09517

EUVD-2026-333351

fkie_cve-2026-28744

GHSA-cc8w-r4qh-3v65 — Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens

WID-SEC-W-2026-1637 — Gitea: Mehrere Schwachstellen