Privilege Escalation in API via Access Token Scope

Executive Summary

CVE-2026-56654 is a privilege escalation flaw in Gitea affecting versions up to 1.26.4. It involves the API endpoint for creating Personal Access Tokens (POST /users/{username}/tokens). The vulnerability occurs when a token is passed in a specific Authorization header format, which tricks the middleware into allowing the request to proceed without proper password authentication. The handler then creates a new token with elevated privileges, even if the original token had restricted access.

Useful 0 Not Useful 0

Detection Guidance

Check Gitea versions up to 1.26.4 for exposure. Monitor API logs for POST requests to /users/{username}/tokens with Authorization headers containing tokens. Look for token creation events where scopes exceed the original token's permissions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a restricted token could escalate their privileges by creating a fully privileged token without knowing the account password. This could allow unauthorized access to sensitive endpoints, data manipulation, or further system compromise depending on the token's scope.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later immediately. Review and revoke any suspicious Personal Access Tokens created before the upgrade. Audit token scopes and disable unnecessary permissions.

Useful 0 Not Useful 0