CVE-2026-26231
Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.
- CVSS 3.1
- 8.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N - EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-25)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mm7c-rhg6-qr4r | Go | code.gitea.io/gitea | <1.26.2 | 1.26.2 |
| GO-2026-5510 | Go | code.gitea.io/gitea | <1.26.2 | 1.26.2 |