Adel Assakaf

Adel Assakaf

Adel Assakaf — Last Publications

Escape research found a scope bypass that made Gitea's restricted tokens full admins. It's now CVE-2026-117635.

Escape research found a scope bypass that made Gitea's restricted tokens full admins. It's now CVE-2026-117635.

A Gitea access token restricted to public resources reached the whole admin API, up to creating a new site administrator. CVE-2026-117635, fixed in v28.3.0.
Adel Assakaf
Adel Assakaf
7 min read

Escape Blog Squad