CVE-2026-26231

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://blog.gitea.com/release-of-1.26.2/
https://github.com/go-gitea/gitea/pull/37479
https://github.com/go-gitea/gitea/pull/37484
https://github.com/go-gitea/gitea/releases/tag/v1.26.2
https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r
https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r

Configurations

No configuration.

History

07 Jul 2026, 18:16

Type	Values Removed	Values Added
References	~~() https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r -~~	() https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r -

03 Jul 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-03 21:16

Updated : 2026-07-07 18:16

NVD link : CVE-2026-26231

Mitre link : CVE-2026-26231

CVE.ORG link : CVE-2026-26231

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-26231", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26231", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T14:44:56.666791Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "affectedData": [{"vendor": "Gitea", "product": "Gitea Open Source Git Server", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.26.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-03T21:16:58.200", "references": [{"url": "https://blog.gitea.com/release-of-1.26.2/", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/pull/37479", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/pull/37484", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.2", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write."}], "lastModified": "2026-07-07T18:16:37.077", "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2"}