EUVD-2026-101087Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown vulnerability
-
ExploitExploit Gitea instance
-
ImpactUndetermined impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation conditions are entirely unknown. No CVSS vector, description, or CWE is available to determine whether special configuration, authentication, network adjacency, or user interaction is required. No statement can be made about whether this affects default or non-default Gitea deployments. |
| Impact | Risk cannot be meaningfully assessed from the available data. No CVSS vector, EPSS score, KEV listing, POC, or vulnerability description is present. The sole intelligence signal is an Alpine Linux vendor package fix entry. Without knowing the attack vector, privileges required, scope, or confidentiality/integrity/availability impact, no comparative risk prioritization is possible. Security teams operating Alpine Linux environments running Gitea should treat the package upgrade as the minimum required action, but cannot assess urgency beyond that without consulting upstream Gitea release notes or the corresponding upstream security advisory. |
| Exploit ScenarioDerived | An exploit scenario cannot be constructed from the available data because the vulnerability description, attack vector, and impact are all absent. No POC or KEV listing exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability details - including attack vector, impact, and root cause - are not disclosed in the available intelligence data. The fix is confirmed via the Alpine Linux vendor advisory, but no NVD description, CVSS vector, CWE classification, or technical writeup accompanies this CVE record at the time of analysis.
RemediationAI
Upgrade the Alpine Linux gitea package to version 1.27.3-r0 or later using the standard Alpine package manager: 'apk upgrade gitea'. No workarounds or compensating controls can be recommended because the vulnerability's nature is unknown. Administrators should also consult the upstream Gitea security advisories and release notes for version 1.27.3 to understand whether additional configuration changes are recommended alongside the package upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is a lightweight, open-source self-hosted Git service written in Go, commonly packaged and distributed by Linux distributions including Alpine Linux. The Alpine Linux package ecosystem uses its own versioning scheme (e.g., 1.27.3-r0 denotes upstream Gitea 1.27.3, Alpine revision 0). No CWE is assigned, and no CPE string is provided, so the root cause class and exact affected component within Gitea cannot be determined from available data.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB