Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 5 total.
OIDC userinfo scope bypass in Gitea (CVE-2026-55982)
The OIDC userinfo endpoint (`GET /login/oauth/userinfo`) in Gitea accepts personal access tokens as bearer credentials without enforcing their assigned scopes. A token scoped only to `read:misc` - which is denied acce...
Fixed in 1.27.0
Token scope bypass on archive download endpoint in Gitea (CVE-2026-20706)
The `/archive/*` web endpoint in Gitea does not enforce token scope checks, unlike the `/raw/*`, `/media/*`, and attachment endpoints fixed in PR #37698. A personal access token scoped to any non-repository category (...
Fixed in 1.26.2
Authorization bypass in Gitea pull request update API endpoint (CVE-2026-58443)
Gitea fails to re-apply a token's public-only restriction when the pull request update endpoint (`POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update`) operates on a private head repository. The publi...
Fixed in 1.27.0
Privilege escalation via Personal Access Token scope bypass in Gitea (CVE-2026-56654)
Gitea's API endpoint for creating Personal Access Tokens (`POST /users/{username}/tokens`) can be accessed using an existing token formatted as `Authorization: Basic <token>:x-oauth-basic`. The Basic auth handler sets...
Fixed in 1.27.0
Remember-Me token theft session persistence in Gitea (CVE-2026-56750)
Gitea's Remember-Me authentication fails to invalidate an attacker's session when a stolen token is detected as compromised via hash mismatch. When the legitimate user's original token triggers a hash mismatch, Gitea ...
Fixed in 1.27.0