Description

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

Related CPE's

Could not find any relations

References

https://blog.gitea.com/release-of-1.26.2/

https://github.com/go-gitea/gitea/pull/37479

https://github.com/go-gitea/gitea/pull/37484

https://github.com/go-gitea/gitea/releases/tag/v1.26.2

https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r

https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r

Weaknesses

88ee5874-cf24-4952-aea0-31affedb7ff2

Secondary
CWE-863

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

8.5 · High

Information

Source identifier

88ee5874-cf24-4952-aea0-31affedb7ff2

Vulnerability status

Deferred

Published

2026-07-03T21:16:58.200Z

3 months ago

Last modified

2026-07-07T18:16:37.077Z

3 months ago