EUVD-2026-101081Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown vulnerability triggered
-
ExploitPatch applied in 1.27.3-r0
-
ImpactImpact undisclosed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation conditions are unknown. No description, CVSS vector, or CWE is available to identify whether exploitation requires network access, authentication, specific configuration, or user interaction. No special conditions can be confirmed or denied from available data. Administrators should not assume default configurations are safe or unsafe until the vendor discloses details. |
| Impact | Risk cannot be meaningfully assessed. No CVSS vector is available to evaluate attack vector, complexity, privileges required, or CIA impact. No EPSS score exists. The vulnerability is not in CISA KEV and no POC has been identified. The only confirmed signal is that Alpine Linux designated this a security fix warranting a CVE. Until the upstream Gitea advisory or NVD enrichment provides a description and CVSS, this should be tracked as 'unknown severity - patch available' rather than assigned a risk tier. The absence of CVSS and CWE is a significant gap; administrators should apply the patch and monitor for upstream disclosure. |
| Exploit ScenarioDerived | The attack scenario cannot be constructed - the vulnerability type, attack vector, and required conditions are entirely undisclosed. Once the upstream Gitea advisory is published, a scenario can be derived from the CVSS vector and description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea packaged in Alpine Linux contains an uncharacterized security vulnerability addressed in Alpine package version 1.27.3-r0. The nature, class, and impact of the underlying flaw are not disclosed in available data - only the fixed package version is confirmed. No CVSS score, CWE classification, or vulnerability description has been published, making independent risk assessment impossible at this time. No public exploit or CISA KEV listing exists.
RemediationAI
Upgrade the Gitea Alpine Linux package to version 1.27.3-r0 or later using the Alpine package manager: apk upgrade gitea. If running Gitea from the upstream binary rather than the Alpine package, monitor the Gitea project releases at https://github.com/go-gitea/gitea/releases for a corresponding security release note tied to version 1.27.3. No workarounds can be recommended because the vulnerability class is unknown - generic network-level controls (firewall, authentication proxy) may or may not be relevant depending on the actual attack vector, which has not been disclosed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is a self-hosted Git service written in Go, widely used for source code management in enterprise and open-source environments. This CVE tracks a security fix applied to the Alpine Linux package of Gitea, updated to version 1.27.3-r0 in the Alpine package repository. Without a CWE classification or description, the root cause class - whether authentication, injection, path traversal, access control, or another category - cannot be determined from available data. The fix version suggests alignment with Gitea upstream release 1.27.3.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
2DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB