CVE-2026-56654: CWE-284 in Gitea Gitea Open Source Git Server
Privilege Escalation via Access Token Scope Escalation in API
AI Analysis
Technical Summary
Gitea before version 1.27.0 contains a privilege escalation vulnerability (CVE-2026-56654) in its API endpoint for creating Personal Access Tokens. The authentication middleware mishandles tokens passed in Basic auth format by treating them as password authentication, which bypasses scope restrictions. Consequently, an attacker possessing a token with limited privileges can exploit this flaw to generate a new token with full privileges without knowing the user's password. This vulnerability is classified under CWE-287 (Improper Authentication) and has a high severity rating. A patch is available to fix this issue.
Potential Impact
An attacker with a limited-scope personal access token can escalate privileges by creating a new token with full privileges without requiring the account password. This can lead to unauthorized access and control over the affected Gitea instance's resources and data.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Gitea to version 1.27.0 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-56654: CWE-284 in Gitea Gitea Open Source Git Server
Description
Privilege Escalation via Access Token Scope Escalation in API
CVSS v3.1
Score 9.8critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Gitea before version 1.27.0 contains a privilege escalation vulnerability (CVE-2026-56654) in its API endpoint for creating Personal Access Tokens. The authentication middleware mishandles tokens passed in Basic auth format by treating them as password authentication, which bypasses scope restrictions. Consequently, an attacker possessing a token with limited privileges can exploit this flaw to generate a new token with full privileges without knowing the user's password. This vulnerability is classified under CWE-287 (Improper Authentication) and has a high severity rating. A patch is available to fix this issue.
Potential Impact
An attacker with a limited-scope personal access token can escalate privileges by creating a new token with full privileges without requiring the account password. This can lead to unauthorized access and control over the affected Gitea instance's resources and data.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Gitea to version 1.27.0 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-683j-3ff6-hh2x
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-56654"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a600abb9c2644c7f8fe2b72
Added to database: 07/22/2026, 00:11:39 UTC
Last enriched: 08/14/2026, 12:56:56 UTC
Last updated: 09/12/2026, 10:01:32 UTC
Views: 97
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.