CVE-2026-28699

HighCVSS 8.1/10Last modified Oct 25, 2026

Description

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284CWE-863

Affected software

VendorProductVersions
GiteaGitea Open Source Git Server<= 1.26.1

References

Timeline

Published
Jul 3, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-28708.8A security flaw has been discovered in Tenda A21 1.0.0.0. Affected by this issue is the function set_qosMib_list of the file /goform/formSetCVE-2026-287005.4Uncontrolled search path for some EquiTriton before version f5ddbb5 within Ring 3: User Applications may allow an escalation of privilege. UCVE-2026-287015.3Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directoCVE-2026-287026.3Incorrect default permissions for the Intel(R) VTune(TM) Profiler software within Ring 3: User Applications may allow an escalation of priviCVE-2026-287034.8Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.CVE-2026-287048.4Emocheck insecurely loads Dynamic Link Libraries (DLLs). If a crafted DLL file is placed to the same directory, an arbitrary code may be exeCVE-2026-287055.3Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing speciCVE-2026-287075.4Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege. UCVE-2026-287094.3Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (LinuCVE-2026-28718.8A weakness has been identified in Tenda A21 1.0.0.0. This affects the function fromSetIpMacBind of the file /goform/SetIpMacBind. This manipCVE-2026-287109.8Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber ProtectCVE-2026-287116.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) befor
CVE-2026-28699: High severity, CVSS 8.1 | Vulnix