CVE Explorer
CVE-2026-26231
Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Gitea Open Source Git Server","vendor":"Gitea","versions":[{"lessThanOrEqual":"1.26.1","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:0742dbb3f5f5e518deaab794faf7b85473972b00cb96f32914b763934dfe7757 · sha256:25ef7e83d5f772a2… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:0742dbb3f5f5e518deaab794faf7b85473972b00cb96f32914b763934dfe7757 · sha256:25ef7e83d5f772a2… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-863","description":"CWE-863","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:0742dbb3f5f5e518deaab794faf7b85473972b00cb96f32914b763934dfe7757 · sha256:25ef7e83d5f772a2… · /containers/cna/problemTypes/0/descriptions/0
Source references
6 source assertions{"name":"Gitea v1.26.2 Release Blog Post","tags":["release-notes"],"url":"https://blog.gitea.com/release-of-1.26.2/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:0742dbb3f5f5e518deaab794faf7b85473972b00cb96f32914b763934dfe7757 · sha256:25ef7e83d5f772a2… · /containers/cna/references/4
{"name":"GitHub Pull Request #37479","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/37479"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:0742dbb3f5f5e518deaab794faf7b85473972b00cb96f32914b763934dfe7757 · sha256:25ef7e83d5f772a2… · /containers/cna/references/1
{"name":"GitHub Pull Request #37484","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/37484"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:0742dbb3f5f5e518deaab794faf7b85473972b00cb96f32914b763934dfe7757 · sha256:25ef7e83d5f772a2… · /containers/cna/references/2
{"name":"Gitea v1.26.2 Release","tags":["release-notes"],"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.2"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:0742dbb3f5f5e518deaab794faf7b85473972b00cb96f32914b763934dfe7757 · sha256:25ef7e83d5f772a2… · /containers/cna/references/3
{"tags":["exploit"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:0742dbb3f5f5e518deaab794faf7b85473972b00cb96f32914b763934dfe7757 · sha256:25ef7e83d5f772a2… · /containers/adp/0/references/0
{"name":"GitHub Security Advisory","tags":["vendor-advisory"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:0742dbb3f5f5e518deaab794faf7b85473972b00cb96f32914b763934dfe7757 · sha256:25ef7e83d5f772a2… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.