{"id":"EUVD-2026-41644","enisaUuid":"ec2675a4-d865-30c4-9e3a-4e3fd6938105","description":"Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.","datePublished":"Jul 3, 2026, 8:19:40 PM","dateUpdated":"Jul 6, 2026, 3:17:58 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-cc8w-r4qh-3v65\nhttps://github.com/go-gitea/gitea/pull/37583\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.2\nhttps://blog.gitea.com/release-of-1.26.2/\n","aliases":"CVE-2026-28744\nGHSA-cc8w-r4qh-3v65\n","assigner":"Gitea","epss":0.43,"enisaIdProduct":[{"id":"7bbd8152-7246-3f6d-ac8d-a528ca52d6e6","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.1"}],"enisaIdVendor":[{"id":"428bdeb4-7d1d-38d5-a252-3a45b8972c27","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"675c107c-3dd9-3d80-a8b0-8b1cdfdaa2a3","vulnerability":{"id":"GHSA-cc8w-r4qh-3v65","description":"Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens","datePublished":"Jun 16, 2026, 11:38:12 PM","dateUpdated":"Jun 16, 2026, 11:38:12 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-cc8w-r4qh-3v65\nhttps://github.com/go-gitea/gitea\n","enisa_id":"EUVD-2026-41644\n","aliases":"CVE-2026-28744\nGHSA-cc8w-r4qh-3v65\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b01eaf32-8839-3a09-8eb9-605279a60d9a","vulnerability":{"id":"CVE-2026-28744","description":"Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.","datePublished":"Jul 3, 2026, 8:19:40 PM","dateUpdated":"Jul 6, 2026, 3:17:58 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-cc8w-r4qh-3v65\nhttps://github.com/go-gitea/gitea/pull/37583\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.2\nhttps://blog.gitea.com/release-of-1.26.2/\n","enisa_id":"EUVD-2026-41644\n","assigner":"Gitea","epss":0.43,"dataProcessed":"Nov 7, 2026, 7:24:07 AM","vulnerabilityProduct":[{"id":"30aa07ee-aacc-3587-b626-0475b52e9edb","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.1"}],"vulnerabilityVendor":[{"id":"abf84ed1-db8b-3f29-86c0-efcfa23cabb1","vendor":{"name":"Gitea"}}]}}],"enisaIdAdvisory":[]}