CVE-2026-27783 Details
Description
Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.
A vulnerability exists in Gitea versions through 1.26.1, where three API endpoints related to issue templates and configuration do not enforce proper authorization. This oversight allows users with access to private repositories through non-Code units (such as Issues) to read sensitive template and configuration files from the repository's Code default branch. The affected endpoints are 'GET /repos/{owner}/{repo}/issue_templates', 'GET /repos/{owner}/{repo}/issue_config', and 'GET /repos/{owner}/{repo}/issue_config/validate'. The lack of authorization middleware on these endpoints creates a bypass that could lead to unauthorized access to repository configuration data.
Users can upgrade to Gitea version 1.26.2, which patches this vulnerability by adding the missing authorization checks on the affected API endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 3, 2026CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-gitea/gitea/security/advisories/GHSA-3fwp-p5rj-2pxf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://blog.gitea.com/release-of-1.26.2/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/37769 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/37781 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.26.2 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-3fwp-p5rj-2pxf | Gitea Limited | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 1.26.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | Gitea Limited |