CVE-2026-26231

Gitea maintainer-edit permissions allow unauthorized commits to readable repositories

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

Affected

Gitea · Gitea Open Source Git Server

CVSS v3.1 CNA

8.5 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

EPSS

0.35% chance of exploitation in the next 30 days, 27th percentile

Published

2026-07-03

Updated

2026-07-07

Proof-of-concept exploits (1)

• advisories/GHSA-mm7c-rhg6-qr4r

References

• CVE Record
• NVD entry