CVE-2026-27775

HighCVSS 8.8/10Last modified Oct 25, 2026

Description

Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Gitea	Gitea Open Source Git Server	1.25.5

References

Timeline

Published: Jul 3, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-277768.8IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only when IM-LogicDesign CVE-2026-277776.5Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-277787.5The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting m CVE-2026-277797.5Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL CVE-2026-277810.0Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox CVE-2026-277809.8Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to CVE-2026-277813.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-277834.3Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.CVE-2026-277847.8The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-CVE-2026-277858.8Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.CVE-2026-277875.1Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be ex CVE-2026-277888.5Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerabi