What is the CVSS score of CVE-2026-0798?

CVE-2026-0798 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gitea are affected by CVE-2026-0798?

CVE-2026-0798 is a low-severity vulnerability involving access control (CVSS 3.5).. A patch is available.

How to fix or mitigate CVE-2026-0798?

During next maintenance window: Apply vendor patches when convenient. Verify access control controls are in place.

Gitea CVE-2026-0798

LOW

Improper Access Control (CWE-284)

2026-01-22 88ee5874-cf24-4952-aea0-31affedb7ff2

GHSA-8fwc-qjw5-rvgp

Authentication Bypass Gitea

3.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 29, 2026 - 21:59 nvd

Patch available

CVE Published

Jan 22, 2026 - 22:16 nvd

LOW 3.5

DescriptionCVE.org

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.

AnalysisAI

Gitea may send release notification emails for private repositories to users whose access has been revoked. [CVSS 3.5 LOW]

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	CVSS 3.5 (LOW). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker could exploit this vulnerability to compromise the affected system.
Remediation	A vendor patch is available — apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

During next maintenance window: Apply vendor patches when convenient. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-28737 HIGH This Week

8.7 Jun 17

Stored cross-site scripting in Gitea 1.25.x affects the built-in 3D file viewer (Online3DViewer integration) where a cra

CVE-2026-26231 HIGH This Week

8.5 Jun 16

Authorization bypass in Gitea versions up to and including 1.26.1 allows any authenticated user with mere read access to

CVE-2026-28699 HIGH This Week

8.1 Jun 16

OAuth2 scope enforcement bypass in Gitea <= 1.26.1 allows any OAuth2 access token to perform write actions far beyond it

CVE-2026-28744 HIGH This Week

8.1 Jun 16

Authorization scope bypass in Gitea v1.26.1 and earlier allows authenticated users to use OAuth2/PAT Bearer tokens to pe

CVE-2026-24791 HIGH This Week

8.1 Jun 17

Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran

CVE-2026-0798 vulnerability details – vuln.today

Back