Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks. The flaw, identified as CWE-863, could enable an attacker who possesses a valid bearer token to access or modify repository resources beyond the intended permissions of that token.

The vulnerability affects the Gitea Open Source Git Server product, specifically all releases through version 1.26.1. Users on those versions are at risk until they apply the fix available in later releases.

The CVSS score of 8.1 indicates a high severity, and the EPSS score of < 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can issue a Smart HTTP request that appears to be within scope but is accepted by the server. If an attacker already possesses a bearer token, they can leverage this bypass to gain elevated access without changing the trust level of the token.