VulnSocial

CVE-2026-28699PoC

LOWCVSS 8.1 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-284CWE-863

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-06-11); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-11: 1Mentions · 2026-07-06: 1PoC Mentioned / Linked · 2026-06-11: 1Patch / Workaround · 2026-07-06: 1Technical Details · 2026-06-11: 1Technical Details · 2026-07-06: 106-1107-06
Signal classification2 categories
PoC
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-111
PoC1
2026-07-061
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    #CVE-2026-28699 - High severity supply chain attack in #Gitea. #OAuth2 scope bypass via HTTP Basic auth. #CVSS 8.1. Unpatched. Update immediately if using affected versions. #CVEAlert #git #github #developers #sysadmin #100daysofcode #infosec #ubuntu #python https://www.valtersit.com/cve/CVE-2026-28699

    Post summary

    CVE‑2026‑28699 is a high‑severity supply‑chain flaw in Gitea enabling an OAuth2 scope bypass with HTTP Basic authentication; no PoC or exploit details are disclosed, nor evidence of active attacks, but users are urged to apply the patch immediately.

    0001060
    974 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    PoC

    CVE-2026-28699 CVE-2026-28699 — Gitea OAuth2 Scope Bypass via HTTP Basic Auth Self-contained lab + writeup for CVE-2026-28699 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28699

    Post summary

    A self‑contained lab and writeup for CVE‑2026‑28699 is shared, revealing an OAuth2 scope bypass in Gitea via HTTP Basic Auth. No evidence of active exploitation, patch availability, or false‑positive status is provided.

    0000059
    4.0K followersView on X

Explore more

Back to dashboard