What is the CVSS score of CVE-2026-27657?

CVE-2026-27657 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Gitea are affected by CVE-2026-27657?

Gitea instances before version 1.25.5 contain an authorization flaw allowing authenticated users to manipulate other users' primary email addresses, enabling account takeover and credential…. A patch is available.

How to fix or mitigate CVE-2026-27657?

Within 24 hours, identify all Gitea deployments in your environment and verify current versions; flag any instances below 1.25.5 as requiring immediate remediation. Within 7 days, apply the vendor patch by upgrading all affected Gitea instances to version 1.25.5 or later, following the vendor's upgrade procedure and conducting a post-upgrade smoke test. Within 30 days, audit user activity logs for any unauthorized email address changes on affected systems during the vulnerability window, and review access controls on sensitive administrative accounts.

Gitea CVE-2026-27657

EUVD-2026-41632 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-03 Gitea

GHSA-4c8f-3m6h-m56r

Gitea Authentication Bypass Gitea Open Source Git Server

7.5

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable web endpoint with low complexity, but the vulnerable code path and patch tests require a logged-in account so PR:L not PR:N; impact is integrity-only (another user's email) with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 18:32 vuln.today

Analysis Generated

Jul 22, 2026 - 18:32 vuln.today

CVE Published

Jul 03, 2026 - 20:19 cve.org

HIGH 7.5

CVE Published

Jul 03, 2026 - 20:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Gitea versions before 1.25.5 allow a user to change another user's primary email address.

AnalysisAI

Broken object-level authorization (IDOR) in Gitea before 1.25.5 lets an authenticated user manipulate the primary email address of an arbitrary other account by supplying an email row ID they do not own. The account-settings 'make primary' handler looked up the target email by ID alone without verifying ownership, so a logged-in attacker can alter another user's primary email - an integrity impact with account-hijack and notification-redirection potential. There is no public exploit or active exploitation, EPSS is low (0.17%), and Gitea has shipped a fix in 1.25.5.

Technical ContextAI

Gitea is a self-hosted, lightweight open-source Git service (cpe:2.3:a:gitea:gitea_open_source_git_server) written in Go. The root cause is CWE-639, Authorization Bypass Through User-Controlled Key: the web account handler EmailPost in routers/web/user/setting/account.go passed the attacker-controlled form field 'id' straight into user_model.MakeActiveEmailPrimary, and makeEmailPrimaryInternal in models/user/email_address.go queried the email row using only ID(emailID) with an is_activated filter - never scoping to the requesting user's UID. Because email row IDs are sequential integers, any authenticated user could reference another user's email record. The PR 36586 fix adds an ownerID (ctx.Doer.ID) parameter and constrains the query with builder.Eq{"uid": ownerID}, returning an 'email address could not be found' error when the row is not owned by the caller.

RemediationAI

Vendor-released patch: upgrade to Gitea 1.25.5 or later, which adds owner-scoping (uid) to the primary-email query (fix commits in https://github.com/go-gitea/gitea/pull/36586 and https://github.com/go-gitea/gitea/pull/36607; release https://github.com/go-gitea/gitea/releases/tag/v1.25.5). If immediate upgrade is not possible, reduce exposure by disabling open self-registration (set service.DISABLE_REGISTRATION or require admin approval) to limit who can obtain an account and reach the vulnerable /user/settings/account/email endpoint, and by restricting network access to the Gitea instance to trusted users - note these controls only shrink the attacker pool and do not close the IDOR, so patching remains necessary. Monitor account-settings activity and audit unexpected primary-email changes as an interim detection measure.