PT-2026-50138 · Gitea+1 · Gitea+1
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Gitea versions prior to 1.26.1
Description
In the Git Smart HTTP path, the system fails to enforce repository-scoped access-token permissions when tokens are provided via Bearer authentication. While the
CheckRepoScopedToken() function is designed to validate scopes, it returns early if the request is not using HTTP Basic authentication. Consequently, a Personal Access Token (PAT) or OAuth2 token sent as Authorization: Bearer <token> bypasses scope checks entirely.This allows a token with limited permissions (for example, only
read:notification) to perform operations such as cloning or fetching private repositories without the read:repository scope, or pushing to repositories without the write:repository scope, provided the token owner has the necessary repository RBAC permissions. The issue affects the CheckRepoScopedToken() function and impacts Git Smart HTTP routes.Recommendations
Update Gitea to version 1.26.1 or later.
Exploit
Fix
DoS
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitea
Red Os