{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101023", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-10-04T22:02:04.874Z", "datePublished": "2026-10-06T21:34:53.642Z", "dateUpdated": "2026-10-07T20:04:04.946Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-10-06T21:34:53.642Z"}, "title": "Gitea OAuth2 refresh token grant accepts access tokens", "descriptions": [{"lang": "en", "value": "Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime."}], "affected": [{"vendor": "Gitea", "product": "Gitea", "packageName": "gitea.dev", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "28.0.0", "versionType": "semver"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-469m-x4mw-38r3", "name": "GitHub Security Advisory GHSA-469m-x4mw-38r3", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39501", "name": "Fix: go-gitea/gitea pull request #39501", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/39507", "name": "Fix backport to release/v28: go-gitea/gitea pull request #39507", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.1.0/", "name": "Gitea 28.1.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.1.0", "name": "go-gitea/gitea v28.1.0 release", "tags": ["release-notes"]}], "credits": [{"lang": "en", "value": "https://github.com/rezmoss", "type": "reporter"}, {"lang": "en", "value": "https://github.com/manus-use", "type": "reporter"}, {"lang": "en", "value": "https://github.com/danieltk76", "type": "reporter"}, {"lang": "en", "value": "https://github.com/gigioneggiando", "type": "reporter"}, {"lang": "en", "value": "https://github.com/DshtAnger", "type": "reporter"}, {"lang": "en", "value": "https://github.com/manus-pi", "type": "reporter"}, {"lang": "en", "value": "https://github.com/silverwind", "type": "remediation developer"}, {"lang": "en", "value": "https://github.com/bircni", "type": "remediation developer"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T20:03:22.628993Z", "id": "CVE-2026-101023", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T20:04:04.946Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-101023", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-07T20:03:22.628993Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T20:03:59.475Z"}}], "cna": {"title": "Gitea OAuth2 refresh token grant accepts access tokens", "credits": [{"lang": "en", "type": "reporter", "value": "https://github.com/rezmoss"}, {"lang": "en", "type": "reporter", "value": "https://github.com/manus-use"}, {"lang": "en", "type": "reporter", "value": "https://github.com/danieltk76"}, {"lang": "en", "type": "reporter", "value": "https://github.com/gigioneggiando"}, {"lang": "en", "type": "reporter", "value": "https://github.com/DshtAnger"}, {"lang": "en", "type": "reporter", "value": "https://github.com/manus-pi"}, {"lang": "en", "type": "remediation developer", "value": "https://github.com/silverwind"}, {"lang": "en", "type": "remediation developer", "value": "https://github.com/bircni"}], "affected": [{"vendor": "Gitea", "product": "Gitea", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "28.0.0"}], "packageName": "gitea.dev", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-469m-x4mw-38r3", "name": "GitHub Security Advisory GHSA-469m-x4mw-38r3", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39501", "name": "Fix: go-gitea/gitea pull request #39501", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/39507", "name": "Fix backport to release/v28: go-gitea/gitea pull request #39507", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.1.0/", "name": "Gitea 28.1.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.1.0", "name": "go-gitea/gitea v28.1.0 release", "tags": ["release-notes"]}], "descriptions": [{"lang": "en", "value": "Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime."}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-10-06T21:34:53.642Z"}}}, "cveMetadata": {"cveId": "CVE-2026-101023", "state": "PUBLISHED", "dateUpdated": "2026-10-07T20:04:04.946Z", "dateReserved": "2026-10-04T22:02:04.874Z", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "datePublished": "2026-10-06T21:34:53.642Z", "assignerShortName": "Gitea"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "gitea.dev", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThanOrEqual": "28.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*", "matchCriteriaId": "A392C59B-D9D1-41C2-BBEC-C0E388C35439", "versionEndExcluding": "28.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime."}], "id": "CVE-2026-101023", "lastModified": "2026-10-13T14:39:07.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101023", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T20:03:22.628993Z", "version": "2.0.3"}}]}, "published": "2026-10-06T22:16:59.737", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Release Notes"], "url": "https://blog.gitea.com/release-of-28.1.0/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Patch"], "url": "https://github.com/go-gitea/gitea/pull/39501"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Patch"], "url": "https://github.com/go-gitea/gitea/pull/39507"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Release Notes"], "url": "https://github.com/go-gitea/gitea/releases/tag/v28.1.0"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Vendor Advisory"], "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-469m-x4mw-38r3"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "code.gitea.io/gitea: Gitea: Prolonged access via improper OAuth2 token type validation", "id": "2547224", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547224"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-1287", "details": ["Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime.", "A flaw was found in Gitea. The OAuth2 (Open Authorization) token endpoint validates the signature and grant of a token during a refresh request, but fails to confirm that the submitted token is specifically a refresh token. An attacker or user possessing a valid, unexpired access token can exchange it for a new access token and refresh token. This allows unauthorized actors to maintain persistent access to the application beyond the original token's intended expiration time."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-101023", "public_date": "2026-10-06T21:34:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-101023\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101023\nhttps://blog.gitea.com/release-of-28.1.0/\nhttps://github.com/go-gitea/gitea/pull/39501\nhttps://github.com/go-gitea/gitea/pull/39507\nhttps://github.com/go-gitea/gitea/releases/tag/v28.1.0\nhttps://github.com/go-gitea/gitea/security/advisories/GHSA-469m-x4mw-38r3"], "statement": "A MODERATE severity flaw was found in Gitea, which is bundled as a dependency in Red Hat's Konflux OpenShift Pipeline container images pipelines-pipelines-as-code-controller-rhel9 and pipelines-pipelines-as-code-watcher-rhel9. Gitea's OAuth2 token endpoint verifies the signature and grant of a token submitted with the refresh_token grant type, but does not verify that the submitted token is actually a refresh token. As a result, an attacker who already possesses a valid, unexpired OAuth2 access token for the same OAuth2 application and grant can submit it to the token endpoint and exchange it for a new access token and refresh token, maintaining access to the application beyond the original token's intended expiration. There is no impact to availability. Red Hat rates this flaw as MODERATE (CVSS 3.1 score 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) because exploitation requires possession of a valid access token and the impact is limited to the confidentiality and integrity allowed by the token's granted scopes; this differs from the higher external CISA score of 9.1, which assumes no privileges are required and high confidentiality and integrity impact. Because the impact is MODERATE with a CVSS score below 7.0, the fix for the affected Konflux components has been deferred, as Red Hat does not file trackers for MODERATE severity flaws without a high CVSS score; the residual risk is that an actor who has already obtained a valid access token can prolong that access, limited to the token's granted scopes.", "threat_severity": "Moderate"}