Vulnerability advisory

CVE-2026-27775

Gitea pre-receive hook permission cache allows full repository write access

Published Jul 3, 2026Updated Oct 28, 2026OSV record ↗

Also known as GHSA-649p-mmhf-85c7GO-2026-6043

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/go-gitea/gitea ↗
f913d90ab664c1deccdfbe8c563abb13e897d62b to before 4aa0d704f2c7d30351016b740bfc45247fd77efa	`4aa0d704f2c7d30351016b740bfc45247fd77efa`
Also listed as affected (1) `1.25.5`

Description

Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

References

Advisoryblog.gitea.com/release-of-1.26.3-and-1.26.4/ ↗
Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27775.json ↗
Advisorygithub.com/go-gitea/gitea/releases/tag/v1.26.3 ↗
Advisorygithub.com/go-gitea/gitea/security/advisories/GHSA-649p-mmhf-85c7 ↗
Advisorynvd.nist.gov/vuln/detail/CVE-2026-27775 ↗
Fixgithub.com/go-gitea/gitea/pull/38151 ↗