Privilege escalation via Personal Access Token scope bypass in Gitea (CVE-2026-56654)

Gitea's API endpoint for creating Personal Access Tokens (`POST /users/{username}/tokens`) can be accessed using an existing token formatted as `Authorization: Basic <token>:x-oauth-basic`. The Basic auth handler sets `AuthedMethod="basic"`, causing `IsBasicAuth=true` and bypassing the `reqBasicOrRevProxyAuth` middleware that is intended to require password-based authentication. Because the token creation handler enforces no scope ceiling, an attacker with any restricted token can create a new fully-privileged `all`-scoped token without knowing the account password. Affected versions: - <= 1.26.4 We recommend updating to: 1.27.0. CVSS ? · our assessment: this_week Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-683j-3ff6-hh2x Details: https://vuln.today/cve/CVE-2026-56654