CVE-2026-27761

medium

Description

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

References

https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj

https://latesthackingnews.com/2026/07/07/gitea-docker-vulnerability-exploitation/

https://github.com/go-gitea/gitea/releases/tag/v1.26.3

https://github.com/go-gitea/gitea/pull/38147

https://blog.gitea.com/release-of-1.26.3-and-1.26.4/

Details

Source: Mitre, NVD

Published: 2026-07-03

Updated: 2026-07-07

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 4.3

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N