CVE-2026-26231highCWE-863

CVE-2026-26231: fallo de gravedad alta en Gitea Open Source Git Server

Gitea maintainer-edit permissions allow unauthorized commits to readable repositories

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Gitea Open Source Git Server+ Monitorear code.gitea.io/gitea

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.5epss 0.4%
Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Productos afectados
Gitea · Gitea Open Source Git Server
CVEs relacionadas — Gitea Open Source Git Server

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-6886CRITICALInproper Sanitation of field leading to stored XSSEPSS 33.0%CVE-2026-20896CRITICALGitea Docker image trusts spoofable reverse-proxy headers by defaultEPSS 2.8%CVE-2026-27771HIGHGitea Composer package source links use insufficient permission checksEPSS 1.4%CVE-2026-27775HIGHGitea pre-receive hook permission cache allows full repository write accessEPSS 0.9%CVE-2026-56654CRITICALPrivilege Escalation via Access Token Scope Escalation in APIEPSS 0.8%CVE-2026-26292CRITICALGitea LFS mirror synchronization bypasses migration HTTP transport restrictionsEPSS 0.7%