CVE-2026-101023

Summary

The flaw allows an attacker to exchange an unexpired access token for a new access token and refresh token, effectively extending the token's lifetime. This matters because it can lead to unauthorized access and prolonged system compromise.

Exploitability

Exploitation is moderately hard as it requires an attacker to have an unexpired access token for the same OAuth2 application. Precondition is the presence of an unexpired access token.

Blast radius

If exploited, the impact is significant as it could allow unauthorized access to the system for an extended period, potentially leading to data theft or other malicious activities.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the OAuth2 `refresh_token` grant type or upgrade to the latest version of Gitea that addresses this vulnerability, specifically version 1.17.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.