https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:58:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352879 EUVD-2026-352879 https://cve.radiocsirt.org/vuln/euvd-2026-352879 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56654 <p>Privilege Escalation via Access Token Scope Escalation in API</p> <p>Privilege Escalation via Access Token Scope Escalation in API</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56654 https://cve.radiocsirt.org/vuln/ghsa-683j-3ff6-hh2x <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>Gitea&#39;s API endpoint for creating Personal Access Tokens (`POST /users/{username}/tokens`) is protected by a middleware (`reqBasicOrRevProxyAuth`) that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in the `Authorization: Basic &lt;token&gt;:x-oauth-basic` format, the Basic auth handler validates it and sets `AuthedMethod=&#34;basic&#34;`, causing `IsBasicAuth=true` and fooling the middleware into passing the request. Once past the guard, the token creation handler applies no scope ceiling — it will create a new token with any requested scope regardless of the caller&#39;s scope. An attacker with a restricted token (e.g. `write:user` from a leaked CI secret) can therefore create a fully-privileged `all`-scoped token without knowing the account password.</p> <p>### Data flow</p> <p>#### Step 1 - Token extracted from Basic auth header When the attacker sends Authorization: Basic base64(&lt;token&gt;:x-oauth-basic), parseAuthBasic detects that the password is &#34;x-oauth-basic&#34; and treats the username field as the token:</p> <p>https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/services/auth/basic.go#L55-L64</p> <p>`VerifyAuthToken` then validates the token against the database and sets `LoginMethod = &#34;access_token&#34;` and `ApiTokenScope` to the token&#39;s actual scope (`write:user`):</p> <p>https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/services/auth/basic.go#L100-L106</p> <p>#…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>Gitea&#39;s API endpoint for creating Personal Access Tokens (`POST /users/{username}/tokens`) is protected by a middleware (`reqBasicOrRevProxyAuth`) that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in the `Authorization: Basic &lt;token&gt;:x-oauth-basic` format, the Basic auth handler validates it and sets `AuthedMethod=&#34;basic&#34;`, causing `IsBasicAuth=true` and fooling the middleware into passing the request. Once past the guard, the token creation handler applies no scope ceiling — it will create a new token with any requested scope regardless of the caller&#39;s scope. An attacker with a restricted token (e.g. `write:user` from a leaked CI secret) can therefore create a fully-privileged `all`-scoped token without knowing the account password.</p> <p>### Data flow</p> <p>#### Step 1 - Token extracted from Basic auth header When the attacker sends Authorization: Basic base64(&lt;token&gt;:x-oauth-basic), parseAuthBasic detects that the password is &#34;x-oauth-basic&#34; and treats the username field as the token:</p> <p>https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/services/auth/basic.go#L55-L64</p> <p>`VerifyAuthToken` then validates the token against the database and sets `LoginMethod = &#34;access_token&#34;` and `ApiTokenScope` to the token&#39;s actual scope (`write:user`):</p> <p>https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/services/auth/basic.go#L100-L106</p> <p>#…</p> https://cve.radiocsirt.org/vuln/ghsa-683j-3ff6-hh2x https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304