The vulnerability arises because the Gitea API endpoint POST /users/{username}/tokens uses a middleware intended to require password-based authentication to create new Personal Access Tokens (PATs). However, when a token is supplied in the Authorization header as Basic auth with the format 'Basic base64(<token>:x-oauth-basic)', the Basic auth handler validates the token and sets the authentication method to 'basic', causing the middleware to incorrectly allow the request. The token creation handler then creates a new token with any requested scope without verifying that the requested scope is a subset of the caller's token scope. Consequently, an attacker possessing a token with restricted scope (e.g., write:user) can escalate privileges by creating a new token with full 'all' scope, gaining complete account access.

An attacker with a restricted Personal Access Token can bypass authentication checks and create a new token with full privileges. This leads to full account compromise without needing the account password. The vulnerability allows scope escalation of API tokens, undermining the security model of token-based authentication in Gitea.

A fix is available in Gitea version 1.27.0 and later. Users should upgrade to version 1.27.0 or newer to remediate this vulnerability. Until patched, avoid using tokens in Basic auth format for API requests that create new tokens, and restrict token scopes and usage carefully. Patch status is confirmed by the absence of affected versions from 1.27.0 onwards.