EUVD-2026-101091Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown entry point
-
ExploitUnknown exploit primitive
-
ImpactUnknown impact on Gitea instance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation conditions cannot be determined - no description, CVSS vector, or CWE is available to identify required access level, configuration state, protocol, or feature enablement. Authentication requirements are not confirmed from available data. Security teams should not assume either unauthenticated or authenticated access is required without consulting the upstream Gitea advisory for 1.27.3. |
| Impact | Risk cannot be meaningfully assessed with the available data. No CVSS vector, EPSS score, KEV status, CWE, or vulnerability description is present. The sole data point is the Alpine Linux vendor advisory naming a fixed package version. CVSS-based prioritization is impossible, and SSVC decision-making cannot progress without knowing the exploitation status, automatable flag, or technical impact. Security teams should treat this as an uncharacterized vulnerability requiring vendor follow-up before risk classification. Gitea's role as a source-code repository host - potentially containing sensitive IP, secrets, and CI/CD pipeline credentials - means that even an uncharacterized vulnerability warrants prompt patching. |
| Exploit ScenarioDerived | Without a known vulnerability type or attack vector, a specific exploit scenario cannot be constructed. As a general risk posture, Gitea instances exposed to the internet with sensitive repositories or CI/CD integrations should be treated as highest-priority update targets until the vulnerability nature is clarified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability in the self-hosted Git service. The vulnerability type, attack vector, and impact are not disclosed in available intelligence - the record consists solely of an Alpine Linux package advisory naming the fixed version. No CVSS score, CWE classification, or description of exploitation conditions has been published at this time.
RemediationAI
Alpine Linux users running Gitea should upgrade to package version 1.27.3-r0 or later using 'apk upgrade gitea'. Because the underlying vulnerability type is not disclosed, no targeted compensating controls can be recommended - generic mitigations such as restricting network exposure of the Gitea instance to trusted IP ranges and enforcing authentication on all endpoints are prudent interim steps. Users on non-Alpine distributions should consult their respective package maintainers or the upstream Gitea 1.27.3 release notes to determine whether the same fix is included. No vendor advisory URL beyond the Alpine package repository is available in the current intelligence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is a self-hosted, open-source Git service written in Go, widely used in homelab, enterprise, and DevOps environments as an alternative to GitHub or GitLab. Alpine Linux maintains its own packaging of Gitea, and the fix version 1.27.3-r0 corresponds to the Alpine package epoch - the upstream Gitea version addressed is approximately 1.27.3. Without a CWE or description, the root cause class (e.g., authentication bypass, code injection, SSRF, privilege escalation) cannot be determined from available data.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB