PT-2026-55602 · Gitea · Gitea Open Source Git Server

Babakizo420 · Publicado 2026-07-03 · Atualizado 2026-07-03 · CVE-2026-27761

Mitre

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-27761

Produtos afetados

Gitea Open Source Git Server

Referências · 5

• https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj · Aviso do Fabricante
• https://github.com/go-gitea/gitea/pull/38147 · Correção
• https://github.com/go-gitea/gitea/releases/tag/v1.26.3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27761 · Nota de Segurança
• https://blog.gitea.com/release-of-1.26.3-and-1.26.4 · Nota