CVE-2026-28699 is an improper access control vulnerability in Gitea Open Source Git Server affecting versions prior to 1.26.2. The issue allows bypassing OAuth2 access token scope enforcement through HTTP Basic authentication, potentially granting unauthorized access beyond the token's intended permissions. This vulnerability is rated high severity with a CVSS 3.1 score of 8.1, indicating network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality and integrity. No official patch or remediation level has been published by the vendor as of the provided data.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to bypass OAuth2 token scope restrictions, potentially leading to unauthorized access to sensitive data or operations within the Gitea server. The impact affects confidentiality and integrity but not availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected Gitea versions and monitor for updates from the vendor. Avoid relying solely on OAuth2 token scopes for access control in affected versions.