CVE-2026-28744 affects Gitea Open Source Git Server versions up to 1.26.1. The vulnerability allows an attacker with a bearer token to bypass repository token scope checks when making Git smart HTTP requests. This improper authorization flaw (CWE-863) could enable unauthorized access or modification of repository data. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and requires low privileges but no user interaction. Confidentiality and integrity impacts are high, while availability is not affected.

Successful exploitation allows bypassing repository token scope checks, potentially enabling unauthorized access to or modification of repository contents. This compromises the confidentiality and integrity of affected repositories. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor Gitea's official channels for updates and apply patches once available. Until then, consider restricting bearer token usage and reviewing repository access policies to limit potential exposure.