CVE-2026-27660CWE-284

Gitea draft releases use insufficient permission checks

High · published July 3, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea draft releases use insufficient permission checks
    cvelistv5