EUVD-2026-41636
GHSA-649p-mmhf-85c7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an existing per-branch write grant (PR:L) over the network with no interaction (AV:N/AC:L/UI:N); impact is primarily repository-write integrity (I:H) with limited confidentiality/availability effect (C:L/A:L).
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.
AnalysisAI
Privilege escalation in Gitea 1.25.5 lets a user holding a per-branch maintainer-edit grant reuse that write permission against other refs and obtain full repository write access. The flaw stems from a branch-specific permission result being cached and incorrectly reused across multiple refs within a single pre-receive hook session. It is an authenticated authorization-bypass (CWE-863) fixed in Gitea 1.26.3; no public exploit has been identified and EPSS exploitation probability is low (0.20%).
Technical ContextAI
Gitea is a self-hosted, lightweight Git service written in Go, offering repository hosting, pull requests, and fine-grained branch protection. When a Git push is received, Gitea runs a pre-receive hook that evaluates write permission for each ref (branch/tag) being updated. In 1.25.5 the result of a write-permission check - specifically a maintainer/'allow edits' grant scoped to one branch - is cached and applied to the other refs processed in the same hook session, rather than being recomputed per ref. This is a classic CWE-863 (Incorrect Authorization) failure: a decision valid for one object is trusted for a different object, collapsing per-branch access boundaries into repository-wide write. The single affected product is Gitea Open Source Git Server (cpe:2.3:a:gitea:gitea_open_source_git_server), and the root cause was corrected in PR go-gitea/gitea#38151.
RemediationAI
Vendor-released patch: upgrade to Gitea 1.26.3 (or later, e.g. 1.26.4) which corrects the per-ref permission recomputation; see the release notes at https://blog.gitea.com/release-of-1.26.3-and-1.26.4/ and the fix in https://github.com/go-gitea/gitea/pull/38151. Review the advisory at https://github.com/go-gitea/gitea/security/advisories/GHSA-649p-mmhf-85c7 before deploying. If you cannot patch immediately, reduce exposure by not granting 'allow maintainer edits' on pull requests from untrusted contributors and by tightening branch-protection so fewer users hold per-branch write grants - the trade-off is reduced collaboration convenience for external contributors. Avoid exposing the instance to anonymous or low-trust users who can obtain any branch write grant, and audit recent pushes to protected branches for anomalous ref updates; note these are containment measures only and do not close the underlying caching flaw.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today