What is CVE-2026-28699?

CVE-2026-28699 is a high-severity vulnerability in Gitea Open Source Git Server, classified under Improper Access Control. CVSS score: 8.1/10. Published 2026-07-03.

How severe is CVE-2026-28699?

High severity. CVSS v3 base score is 8.1 out of 10.

Is CVE-2026-28699 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Gitea Open Source Git Server

CVE-2026-28699

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Gitea Open Source Git Server — versions 0

Weakness classification (CWE)

Public proof-of-concept exploits

Alardiians/gitea-CVE-2026-28699

References

88ee5874-cf24-4952-aea0-31affedb7ff2 (vendor-advisory)
88ee5874-cf24-4952-aea0-31affedb7ff2 (patch)
88ee5874-cf24-4952-aea0-31affedb7ff2 (release-notes)
88ee5874-cf24-4952-aea0-31affedb7ff2 (release-notes)

Frequently asked questions

What is CVE-2026-28699?: CVE-2026-28699 is a high-severity vulnerability in Gitea Open Source Git Server, classified under Improper Access Control. CVSS score: 8.1/10. Published 2026-07-03.
How severe is CVE-2026-28699?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2026-28699 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.