CVE-2026-101023

CriticalCVSS 9.1/10Last modified Oct 13, 2026

Description

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Gitea	Gitea	<= 28.0.0

References

https://blog.gitea.com/release-of-28.1.0/Release Notes
https://github.com/go-gitea/gitea/pull/39501Patch
https://github.com/go-gitea/gitea/pull/39507Patch
https://github.com/go-gitea/gitea/releases/tag/v28.1.0Release Notes
https://github.com/go-gitea/gitea/security/advisories/GHSA-469m-x4mw-38r3Vendor Advisory

Timeline

Published: Oct 6, 2026
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1010248.8Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authentica CVE-2026-1010255.3Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails CVE-2026-1010277.7When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address ag CVE-2026-1010286.0Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, CVE-2026-1010294.3Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the CVE-2026-101034.3Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync CVE-2026-1010319.1The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` modu CVE-2026-1010327.0navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject she CVE-2026-1010334.3KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated a CVE-2026-1010346.8An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords st CVE-2026-1010355.3A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the library src/lib/nas/encode.cpp CVE-2026-1010365.3A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/m