CVE-2026-101023

Gitea: authentication bypass

Risk score: 65/100
CVSS: 9.1 v3.1
Exploit chance (30 days): 0.4%
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refresh_token grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an acces…
Affected: Gitea
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Gitea: Amber, patch this week. Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pull_request activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow def…

The flaws

CVE-2026-101023: Authentication bypass (CVSS 9.1 · EPSS 0%)
CVE-2026-94205: Incorrect authorisation (CVSS 9.8 · EPSS 0%)
CVE-2026-60004: Gitea Code Injection Vulnerability (exploited)
CVE-2026-73278: Authentication bypass (CVSS 9.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Gitea

Where it stands

Exploited in the wild
On CISA's exploited list since 25 Aug
US federal deadline 28 Aug

How it unfolded

25 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
28 Aug, Deadline (official): US federal agencies must have patched

Connects to

Same weakness: Authentication bypass (CWE-287). 236 other warnings in 30 days
Same product: Earlier Gitea warnings. 25 in the last 90 days

Why it is Amber

CVSS 9.1 critical
Remotely exploitable without logging in

References

Original description

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime.

Last activity 6 Oct 2026. Patch Forecast updates every hour.