CVE-2026-27761 | THREATINT

Description

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

PUBLISHED Reserved 2026-03-03 | Published 2026-07-03 | Updated 2026-07-07 | Assigner Gitea

MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-863

Product status

Default status

unaffected

Any version

affected

Credits

babakizo420 reporter

References

github.com/.../gitea/security/advisories/GHSA-3pww-vcvm-3gmj exploit

github.com/.../gitea/security/advisories/GHSA-3pww-vcvm-3gmj (GitHub Security Advisory) vendor-advisory

github.com/go-gitea/gitea/pull/38147 (GitHub Pull Request #38147) patch

github.com/go-gitea/gitea/releases/tag/v1.26.3 (Gitea v1.26.3 Release) release-notes

blog.gitea.com/release-of-1.26.3-and-1.26.4/ (Gitea v1.26.4 Release Blog Post) release-notes

cve.org (CVE-2026-27761)

nvd.nist.gov (CVE-2026-27761)

Download JSON