CVE-2026-26231

HighCVSS 8.5/10Last modified Oct 25, 2026

Description

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jul 3, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-262329.1Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.CVE-2026-262336.5Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to rate limit login requests which allows CVE-2026-262348.8JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override reque CVE-2026-262357.5JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or reb CVE-2026-262367.5A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access CVE-2026-262377.5A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access CVE-2026-262398.1A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit CVE-2026-26249.8Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall (NGF CVE-2026-262409.1A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modif CVE-2026-262419.1A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modif CVE-2026-262437.2A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit t CVE-2026-262448.8A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit th