CVE-2026-26231

HIGH

Gitea maintainer-edit permissions allow unauthorized commits to readable repositories

Title source: cna
STIX 2.1

Description

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

References (5)

Core 5
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory
https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r
Patch patch
GitHub Pull Request #37479
https://github.com/go-gitea/gitea/pull/37479
Patch patch
GitHub Pull Request #37484
https://github.com/go-gitea/gitea/pull/37484
Release Notes release-notes
Gitea v1.26.2 Release
https://github.com/go-gitea/gitea/releases/tag/v1.26.2
Release Notes release-notes
Gitea v1.26.2 Release Blog Post
https://blog.gitea.com/release-of-1.26.2/

Scores

CVSS v3 8.5
EPSS 0.0029
EPSS Percentile 21.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (1)
Gitea/Gitea Open Source Git Server < 1.26.1
Published Jul 03, 2026
Tracked Since Jul 04, 2026