CVE-2026-56654

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description A privilege escalation issue exists in the API endpoint POST /users/{username}/tokens used for creating Personal Access Tokens. The endpoint is protected by the reqBasicOrRevProxyAuth middleware, which is designed to require password-based authentication to prevent a compromised token from being used to generate new ones. However, if a token is provided in the Authorization: Basic <token>:x-oauth-basic format, the system incorrectly sets the AuthedMethod to basic and IsBasicAuth to true, bypassing the middleware guard.

Once the guard is bypassed, the CreateAccessToken function fails to enforce a scope ceiling, meaning it does not verify if the requested scopes are a subset of the caller's current scopes. Consequently, an attacker possessing a restricted token (such as one with only write:user permissions) can create a new token with the all scope, granting full administrative access to the account without knowing the user's password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.