ByteOS Network

NVD Vulnerability Details :

CVE-2026-27761

Received

Source-88ee5874-cf24-4952-aea0-31affedb7ff2

Published At-03 Jul, 2026 | 21:16

Updated At-03 Jul, 2026 | 21:16

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE ID	Type	Source
CWE-863	Secondary	88ee5874-cf24-4952-aea0-31affedb7ff2

CWE ID: CWE-863

Type: Secondary

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

References

Hyperlink	Source	Resource
https://blog.gitea.com/release-of-1.26.3-and-1.26.4/	88ee5874-cf24-4952-aea0-31affedb7ff2	N/A
https://github.com/go-gitea/gitea/pull/38147	88ee5874-cf24-4952-aea0-31affedb7ff2	N/A
https://github.com/go-gitea/gitea/releases/tag/v1.26.3	88ee5874-cf24-4952-aea0-31affedb7ff2	N/A
https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj	88ee5874-cf24-4952-aea0-31affedb7ff2	N/A