PT-2026-55602 · Gitea · Gitea Open Source Git Server

Babakizo420 · Published 2026-07-03 · Updated 2026-07-03 · CVE-2026-27761

Mitre

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-27761

Affected Products

Gitea Open Source Git Server

References · 5

• https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj · Vendor Advisory
• https://github.com/go-gitea/gitea/pull/38147 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27761 · Security Note
• https://github.com/go-gitea/gitea/releases/tag/v1.26.3 · Note
• https://blog.gitea.com/release-of-1.26.3-and-1.26.4 · Note