ByteOS Network

CVE Vulnerability Details :

CVE-2026-26231

PUBLISHED

More Info Official Page

Assigner-Gitea

Assigner Org ID-88ee5874-cf24-4952-aea0-31affedb7ff2

Published At-03 Jul, 2026 | 20:19

Updated At-03 Jul, 2026 | 20:19

▼CVE Numbering Authority (CNA)

Gitea maintainer-edit permissions allow unauthorized commits to readable repositories

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

Affected Products

Vendor

Gitea

Product

Gitea Open Source Git Server

Default Status

unaffected

Versions

Affected

From 0 through 1.26.1 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-863	CWE-863

Type: CWE

CWE ID: CWE-863

Description: CWE-863

Metrics

Version	Base score	Base severity	Vector
3.1	8.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Version: 3.1

Base score: 8.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Credits

reporter

ddd

References

Hyperlink	Resource
https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r	vendor-advisory
https://github.com/go-gitea/gitea/pull/37479	patch
https://github.com/go-gitea/gitea/pull/37484	patch
https://github.com/go-gitea/gitea/releases/tag/v1.26.2	release-notes
https://blog.gitea.com/release-of-1.26.2/	release-notes