PT-2026-55597 · Gitea · Gitea Open Source Git Server

Aisle Research · Publicado 2026-07-03 · Atualizado 2026-07-03 · CVE-2026-26247

Mitre

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-26247

Produtos afetados

Gitea Open Source Git Server

Referências · 5

• https://github.com/go-gitea/gitea/releases/tag/v1.25.5 · Nota
• https://github.com/go-gitea/gitea/pull/36462 · Correção
• https://github.com/go-gitea/gitea/pull/36477 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-26247 · Nota de Segurança
• https://blog.gitea.com/release-of-1.25.5 · Nota