{"id":"CVE-2026-101023","title":"Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token","summary":"Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant coul…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-287"],"vendor":"gitea","product":"gitea","affected":["gitea < 28.1.0"],"patched":["gitea 28.1.0"],"published":"2026-10-06","updated":"2026-10-13","sourceUpdated":"2026-10-13T14:39:07.980","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101023","references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39501","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39507","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-469m-x4mw-38r3","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101023.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-101023"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101023"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00353,"epssPercentile":0.28798,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-07T20:03:22.628993Z"},"scores":{"nvd":9.1,"vendor":5.4,"adp":9.1},"ingestedAt":"2026-10-06T22:23:15.964Z","slug":"CVE-2026-101023","body":"## Overview\n\nGitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime.\n\n## Affected\n\n- `gitea < 28.1.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `gitea 28.1.0`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-10-07 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101023.json)","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":217804,"id":"CVE-2026-101023","ts":1791410343690,"field":"cvss","old":"5.4","new":"9.1"},{"seq":217803,"id":"CVE-2026-101023","ts":1791410343690,"field":"severity","old":"medium","new":"critical"},{"seq":217101,"id":"CVE-2026-101023","ts":1791360683370,"field":"cvss","old":null,"new":"5.4"},{"seq":217100,"id":"CVE-2026-101023","ts":1791360683370,"field":"severity","old":"none","new":"medium"}]}