{"id":"EUVD-2026-41640","enisaUuid":"a7fb6007-f12e-3b34-86aa-ab1de40deb07","description":"Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.","datePublished":"Jul 3, 2026, 8:19:38 PM","dateUpdated":"Jul 6, 2026, 3:18:39 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc\nhttps://github.com/go-gitea/gitea/pull/37503\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.2\nhttps://blog.gitea.com/release-of-1.26.2/\n","aliases":"CVE-2026-28699\nGHSA-9r5x-wg6m-x2rc\n","assigner":"Gitea","epss":0.55,"enisaIdProduct":[{"id":"d91eb0c8-88ad-3328-a6c5-2f208cb12219","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.1"}],"enisaIdVendor":[{"id":"92678276-eff8-3fbf-bfea-8c601b523a69","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"948c17b4-9cf4-3161-86c9-4e2316e12316","vulnerability":{"id":"CVE-2026-28699","description":"Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.","datePublished":"Jul 3, 2026, 8:19:38 PM","dateUpdated":"Jul 6, 2026, 3:18:39 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc\nhttps://github.com/go-gitea/gitea/pull/37503\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.2\nhttps://blog.gitea.com/release-of-1.26.2/\n","enisa_id":"EUVD-2026-41640\n","assigner":"Gitea","epss":0.55,"dataProcessed":"Nov 2, 2026, 7:20:56 AM","vulnerabilityProduct":[{"id":"9821ad0a-38a9-3f16-9686-6bc329deb28e","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.1"}],"vulnerabilityVendor":[{"id":"c845402c-dd3f-3e00-bbc5-15652d656f8a","vendor":{"name":"Gitea"}}]}},{"id":"bd8dacbd-c6dd-3be2-8338-56b0182f6fca","vulnerability":{"id":"GHSA-9r5x-wg6m-x2rc","description":"Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication","datePublished":"Jun 16, 2026, 11:40:34 PM","dateUpdated":"Jun 16, 2026, 11:40:34 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc\nhttps://github.com/go-gitea/gitea\n","enisa_id":"EUVD-2026-41640\n","aliases":"CVE-2026-28699\nGHSA-9r5x-wg6m-x2rc\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}