What is the CVSS score of CVE-2026-27780?

CVE-2026-27780 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Gitea are affected by CVE-2026-27780?

Gitea self-hosted Git server (versions before 1.26.0) contains a branch-protection bypass vulnerability allowing users with push access to circumvent code review and compliance controls by triggering…. A patch is available.

How to fix or mitigate CVE-2026-27780?

Within 24 hours: inventory all Gitea deployments and their versions; restrict push access to branch-protected repositories if feasible. Within 7 days: upgrade all Gitea instances to v1.26.0 or later. Within 30 days: audit Git log for force-pushes or unexpected merges during the unpatched window; verify branch protection re-enforcement post-upgrade.

Gitea CVE-2026-27780

EUVD-2026-41638 CRITICAL

Incorrect Authorization (CWE-863)

2026-07-03 Gitea

GHSA-vhq7-fwwh-7hjf

Authentication Bypass Gitea Gitea Open Source Git Server

9.8

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Requires an authenticated user with repo push access (PR:L), so not PR:N; impact is writing to protected branches (I:H) with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 16:32 vuln.today

CVSS changed

Jul 06, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 03, 2026 - 20:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

AnalysisAI

Branch-protection bypass in Gitea's self-hosted Git server (all versions before 1.26.0) allows a user with push access to circumvent pre-receive hook enforcement by supplying oversized hook input that trips a bufio.Scanner error the code fails to handle safely. Because Gitea does not fail closed on the scanner error, the protection check is silently skipped and the push is accepted. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and this is not in CISA KEV, but a vendor patch (v1.26.0) is available.

Technical ContextAI

Gitea is a lightweight, self-hosted Git service written in Go, comparable to GitLab/Gitea/GitHub Enterprise for team code hosting. The flaw lives in the server-side pre-receive hook path that enforces branch protection (who may push, force-push, or delete protected refs). Go's bufio.Scanner has a default maximum token size (64KB) and returns bufio.ErrTooLong when a line exceeds it; the vulnerable code treats a Scanner error as an empty/complete read rather than an error condition, so oversized input causes the enforcement logic to terminate early without rejecting the push. This is CWE-863 (Incorrect Authorization): the security decision is reached through a code path that does not fail closed, so a control that should deny by default instead permits.

RemediationAI

Vendor-released patch: upgrade to Gitea 1.26.0 or later (https://github.com/go-gitea/gitea/releases/tag/v1.26.0), which corrects the pre-receive hook handling so bufio.Scanner errors fail closed (fix in https://github.com/go-gitea/gitea/pull/36963). Until you can upgrade, reduce exposure by restricting who holds push/write access to repositories with branch protection and audit collaborator lists, since exploitation requires an account able to push; where feasible, enforce protections through an external mechanism the Git server cannot bypass (e.g., server-side CI gates or a proxy that inspects pushes) rather than relying solely on Gitea's in-process check - with the trade-off of added pipeline complexity. Review push logs on protected branches for anomalous accepted pushes that should have been blocked.