CVE-2026-28699

תיאור (מקור, אנגלית)

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

מדדים

CVSS 3.1

8.1 (HIGH) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS — סבירות ניצול

1% (אחוזון 000) נכון ל-16/8/2026

CWE

CWE-284, CWE-863

קישורים

• https://blog.gitea.com/release-of-1.26.2/
• https://github.com/go-gitea/gitea/pull/37503
• https://github.com/go-gitea/gitea/releases/tag/v1.26.2
• https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc
• https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc