CVE-2026-27761

MEDIUM

Gitea repository feeds bypass API token scope enforcement

Title source: cna
STIX 2.1

Description

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

References (4)

Core 4
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory
https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj
Patch patch
GitHub Pull Request #38147
https://github.com/go-gitea/gitea/pull/38147
Release Notes release-notes
Gitea v1.26.3 Release
https://github.com/go-gitea/gitea/releases/tag/v1.26.3
Release Notes release-notes
Gitea v1.26.4 Release Blog Post
https://blog.gitea.com/release-of-1.26.3-and-1.26.4/

Scores

CVSS v3 4.3
EPSS 0.0037
EPSS Percentile 29.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (2)
code.gitea.io/gitea 0 - 1.26.3Go
Gitea/Gitea Open Source Git Server < 1.26.2
Published Jul 03, 2026
Tracked Since Jul 04, 2026