Vulnerability Description
Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.
CVSS Score
8.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Related Weaknesses (CWE)
References
- https://blog.gitea.com/release-of-1.26.2/
- https://github.com/go-gitea/gitea/pull/37479
- https://github.com/go-gitea/gitea/pull/37484
- https://github.com/go-gitea/gitea/releases/tag/v1.26.2
- https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r
- https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r
FAQ
What is CVE-2026-26231?
CVE-2026-26231 is a vulnerability with a CVSS score of 8.5 (HIGH). Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.
How severe is CVE-2026-26231?
CVE-2026-26231 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-26231?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.