Alardiians

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** Gitea fails to enforce OAuth2 access token scopes when a token is submitted via HTTP Basic authentication instead of a Bearer token. This occurs because the authentication process in `services/auth/basic.go` does not store the token scope in the request context, causing the scope enforcement middleware in `routers/api/v1/api.go` to exit early and permit all actions. Consequently, an OAuth2 application with restricted permissions, such as `read:user`, can perform unauthorized write actions by using the `Authorization: Basic base64(<token>:x-oauth-basic)` format. Affected endpoints include: - 'PATCH /api/v1/user/settings' - 'POST /api/v1/user/emails' - 'POST /api/v1/user/repos' - 'PATCH /api/v1/repos/{owner}/{repo}' - 'DELETE /api/v1/repos/{owner}/{repo}' This allows an attacker with a restricted token to modify user profiles, add email addresses, and create, modify, or delete repositories belonging to the authorizing user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.