CVE-2026-26231 | THREATINT

Description

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

PUBLISHED Reserved 2026-03-03 | Published 2026-07-03 | Updated 2026-07-07 | Assigner Gitea

HIGH: 8.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Problem types

CWE-863

Product status

Default status

unaffected

Any version

affected

Credits

ddd reporter

References

github.com/.../gitea/security/advisories/GHSA-mm7c-rhg6-qr4r exploit

github.com/.../gitea/security/advisories/GHSA-mm7c-rhg6-qr4r (GitHub Security Advisory) vendor-advisory

github.com/go-gitea/gitea/pull/37479 (GitHub Pull Request #37479) patch

github.com/go-gitea/gitea/pull/37484 (GitHub Pull Request #37484) patch

github.com/go-gitea/gitea/releases/tag/v1.26.2 (Gitea v1.26.2 Release) release-notes

blog.gitea.com/release-of-1.26.2/ (Gitea v1.26.2 Release Blog Post) release-notes

cve.org (CVE-2026-26231)

nvd.nist.gov (CVE-2026-26231)

Download JSON