Incorrect authorization in Gitea - CVE-2026-58425
Published: July 14, 2026
Vulnerability identifier: #VU137443
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58425
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information about OAuth tokens issued to other clients.
The vulnerability exists due to incorrect authorization in the IntrospectOAuth endpoint when handling token introspection requests. A remote user can submit another client's access or refresh token to disclose sensitive information about OAuth tokens issued to other clients.
The issue affects responses from the OAuth introspection endpoint and can expose token status, scope, username, and registered claims including the issuing client identifier.
Affected software
Gitea
How to mitigate CVE-2026-58425
Install security update from vendor's website.
Gitea - update to 1.27.0