Vulnerability advisory

CVE-2026-26231

Gitea maintainer-edit permissions allow unauthorized commits to readable repositories

Published Jul 3, 2026Updated Oct 28, 2026OSV record ↗

Also known as GHSA-mm7c-rhg6-qr4rGO-2026-5510

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/go-gitea/gitea ↗
All commits before 2c749ce548b1da0a52835861a87b888e67842d29	`2c749ce548b1da0a52835861a87b888e67842d29`
Also listed as affected (42) `v1.26.1` `v1.26.0` `v1.26.0-rc0` `v1.27.0-dev` `v1.26.0-dev` `v1.25.0-dev` `v1.24.0-dev` `v1.22.0-rc1` `v1.23.0-dev` `v1.22.0-rc0` `v1.21.0-rc0` `v1.22.0-dev` `v1.20.0-rc0` `v1.21.0-dev` `v1.20.0-dev` `v1.19.0-rc0` `v1.18.0-rc0` `v1.19.0-dev` `v1.18.0-dev` `v1.17.0-dev` `v1.16.0-rc1` `v1.15.0-rc1` `v1.16.0-dev` `v1.15.0-dev` `v1.14.0-dev` `v1.13.0-dev` `v1.12.0-dev` `v1.10.5` `v1.11.0-rc1` `v1.10.0-rc1` `v1.11.0-dev` `v1.9.0-rc1` `v1.10.0-dev` `v1.9.0-dev` `v1.7.0-dev` `v1.6.0-rc1` `v1.6.0-dev` `v1.5.0-rc1` `v1.5.0-dev` `v1.1.0` `v1.0.0` `v0.9.99`

Description

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

CVE-2026-26231

Affected versions

Repository

Description

References