PT-2026-48628 · Gitea+1 · Gitea+1
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Gitea (affected versions not specified)
Description
Gitea fails to enforce OAuth2 access token scopes when a token is submitted via HTTP Basic authentication instead of a Bearer token. This occurs because the authentication process in
services/auth/basic.go does not store the token scope in the request context, causing the scope enforcement middleware in routers/api/v1/api.go to exit early and permit all actions. Consequently, an OAuth2 application with restricted permissions, such as read:user, can perform unauthorized write actions by using the Authorization: Basic base64(<token>:x-oauth-basic) format. Affected endpoints include:- 'PATCH /api/v1/user/settings'
- 'POST /api/v1/user/emails'
- 'POST /api/v1/user/repos'
- 'PATCH /api/v1/repos/{owner}/{repo}'
- 'DELETE /api/v1/repos/{owner}/{repo}'
This allows an attacker with a restricted token to modify user profiles, add email addresses, and create, modify, or delete repositories belonging to the authorizing user.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Incorrect Authorization
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gitea
Red Os