CVE-2026-101023

Katalog CVE

CVSS 9.1 · Critical EPSS 0,35%

Kerentanan Improper Authentication pada gitea. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime.

Rincian

Terbit di NVD

6 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/go-gitea/gitea/security/advisories/GHSA-469m-x4mw-38r3 advisory vendor
• https://github.com/go-gitea/gitea/pull/39501 patch
• https://github.com/go-gitea/gitea/pull/39507 patch
• https://blog.gitea.com/release-of-28.1.0/ release notes
• https://github.com/go-gitea/gitea/releases/tag/v28.1.0 release notes