CVE-2026-70402 Details

A vulnerability in Gitea versions through 1.27.2 allows local code execution as the Gitea service account. This issue arises because Gitea creates server-side Git hook directories and scripts with permissions set to 0777, relying on the process umask to restrict access. In environments with a permissive umask, such as 0000 or 0002, the resulting files or directories become group- or world-writable. Consequently, a local user with access to the repository storage can modify a hook or add an executable to a writable hook directory. When a subsequent Git operation is performed, the file is executed as the Gitea service account, potentially leading to unauthorized actions such as modifying repositories or accessing files.

Gitea has released a patch in version 1.27.3. Users should upgrade to this version. Additionally, Gitea can be run with a restrictive umask of 0022 or tighter, and it's important to ensure that the repository storage is not writable by untrusted local users.