CVE-2026-26231CWE-863

Gitea maintainer-edit permissions allow unauthorized commits to readable repositories

High · published July 3, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00351 · 27.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea maintainer-edit permissions allow unauthorized commits to readable repositories
    cvelistv5