CVEvulnerability
CVE-2026-27761
4.3 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-07-03
- Last modified
- 2026-10-25
- Assigner
- 88ee5874-cf24-4952-aea0-31affedb7ff2
- CVSS 3.1 (88ee5874-cf24-4952-aea0-31affedb7ff2)
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-863
Description
Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://blog.gitea.com/release-of-1.26.3-and-1.26.4/ blog.gitea.com
- https://github.com/go-gitea/gitea/pull/38147 github.com
- https://github.com/go-gitea/gitea/releases/tag/v1.26.3 github.com
- https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj github.com
- https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj github.com