CVE record · 1 source
CVE-2026-119625
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope.
- Vendor
- Gitea
- Product
- Gitea
- Weakness
- CWE-863
- Exposure class
- Developer platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope.
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity…