CVE-2026-28744

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.1

Description In the Git Smart HTTP path, the system fails to enforce repository-scoped access-token permissions when tokens are provided via Bearer authentication. While the CheckRepoScopedToken() function is designed to validate scopes, it returns early if the request is not using HTTP Basic authentication. Consequently, a Personal Access Token (PAT) or OAuth2 token sent as Authorization: Bearer <token> bypasses scope checks entirely.

This allows a token with limited permissions (for example, only read:notification) to perform operations such as cloning or fetching private repositories without the read:repository scope, or pushing to repositories without the write:repository scope, provided the token owner has the necessary repository RBAC permissions. The issue affects the CheckRepoScopedToken() function and impacts Git Smart HTTP routes.

Recommendations Update Gitea to version 1.26.1 or later.