8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28744

CVE-2026-28744: Gitea Git smart HTTP bypasses repository token scopes for bearer tokens

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28744

CVE-2026-28744:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.gitea.io/gitea	go	<= 1.26.1	1.26.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the CheckRepoScopedToken function within services/context/permission.go. This function is responsible for verifying if an access token has the necessary scopes to perform operations on a repository. The analysis of the security advisory and the corresponding patch 677ab982bfbe9d72b7479f4618e423f93829371d reveals that the function included a check !ctx.IsBasicAuth. This check meant that the function would immediately return, and thus skip scope validation, if the authentication method was not HTTP Basic Auth.

Git Smart HTTP in Gitea allows for Bearer token authentication (e.g., for Personal Access Tokens or OAuth2 tokens). When such a token was used, ctx.IsBasicAuth would be false, triggering the early exit and bypassing the crucial scope validation. As a result, a token lacking read:repository or write:repository scopes could still be used to clone private repositories or push changes, respectively. The fix removes the !ctx.IsBasicAuth condition, ensuring that token scopes are checked for all API requests, regardless of the authentication mechanism, effectively patching the incorrect authorization vulnerability.

Vulnerable functions

context.CheckRepoScopedToken

services/context/permission.go

The function `CheckRepoScopedToken` contained a logic flaw where it would only validate token scopes for requests made with HTTP Basic Authentication. The condition `!ctx.IsBasicAuth` caused the function to exit early for any other authentication type, such as Bearer tokens. This allowed an attacker with a valid but limited-scope token to bypass repository permission checks and access or modify private repositories via Git Smart HTTP operations.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.