Gitea is a self-hosted Git forge, the kind of service a company runs in-house instead of putting its repositories on GitHub, and it hands out API tokens the way GitHub does, with scopes that narrow what each token may reach.When…

The post Escape research found a scope bypass that made Gitea’s restricted tokens full admins. It’s now CVE-2026-117635. appeared first on Security Boulevard.

Adel Assakaf

Source: Security Boulevard
Source Link: https://securityboulevard.com/2026/11/escape-research-found-a-scope-bypass-that-made-giteas-restricted-tokens-full-admins-its-now-cve-2026-117635/