CVE-2026-27761

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://blog.gitea.com/release-of-1.26.3-and-1.26.4/
https://github.com/go-gitea/gitea/pull/38147
https://github.com/go-gitea/gitea/releases/tag/v1.26.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj
https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Gitea hasta la 1.26.2 inclusive permiten que los puntos finales de los feeds RSS y Atom del repositorio omitan las comprobaciones de alcance de los tokens de acceso de la API, exponiendo datos de commits de repositorios privados a tokens sin el alcance de repositorio requerido.

Information

Published : 2026-07-03 21:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-27761

Mitre link : CVE-2026-27761

CVE.ORG link : CVE-2026-27761

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-27761", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27761", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T14:36:41.805084Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "affectedData": [{"vendor": "Gitea", "product": "Gitea Open Source Git Server", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.26.2"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-03T21:16:58.937", "references": [{"url": "https://blog.gitea.com/release-of-1.26.3-and-1.26.4/", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/pull/38147", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.3", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope."}, {"lang": "es", "value": "Las versiones de Gitea hasta la 1.26.2 inclusive permiten que los puntos finales de los feeds RSS y Atom del repositorio omitan las comprobaciones de alcance de los tokens de acceso de la API, exponiendo datos de commits de repositorios privados a tokens sin el alcance de repositorio requerido."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2"}