The flaw allows the OAuth2 access token scope enforcement to be bypassed via HTTP Basic authentication in Gitea up to and including version 1.26.1. By authenticating with Basic credentials, an attacker can use a token for actions beyond its intended scopes, enabling unauthorized actions on repositories and potentially exposing confidential data. The issue maps to CWE‑863 (Scope Bypass) and CWE‑284 (Improper Authorization).

The vulnerability affects the Gitea Open Source Git Server, specifically all versions up to and including 1.26.1. The latest released version, 1.26.2, contains the fix.

The CVSS score of 8.1 classifies this as high severity. The EPSS score of < 1% indicates a low but nonzero probability of exploitation, and it is not listed in the CISA KEV catalog, so there is no known widespread exploitation yet. The likely attack vector is remote over the network, requiring the attacker to authenticate with Basic credentials; once authenticated, the attacker can use any OAuth2 token without its intended scope checks.