EUVD-2026-101093Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess Gitea instance
-
ExploitExploit undisclosed vulnerability
-
ImpactAchieve undetermined impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation conditions cannot be determined from the available data. No vulnerability description, CVSS vector, or CWE is provided, making it impossible to identify required attack vector, privilege level, user interaction, or configuration prerequisites. Authentication requirements are not confirmed from available data. |
| Impact | Risk assessment is severely constrained by the total absence of CVSS scores, CWE classification, EPSS data, KEV status, and any meaningful vulnerability description. Without a CVSS vector, attack vector, complexity, authentication requirements, and confidentiality/integrity/availability impact cannot be quantified. No public exploit code has been identified, and active exploitation is not confirmed. Given that Gitea deployments typically host sensitive intellectual property, authentication secrets, and deployment pipeline credentials, even organizations running a modest self-hosted instance should treat any uncharacterized security fix as a priority patch. The lack of supporting data means defenders cannot triage by impact and should default to patching on a standard rapid-response schedule. |
| Exploit ScenarioDerived | An exploit scenario cannot be constructed from the available data, as the vulnerability type, affected component, and required conditions are undisclosed. No public proof-of-concept exists at time of analysis. Organizations should treat the risk as indeterminate and prioritize patching until the underlying issue is publicly documented. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The specific vulnerability class, affected component, and attacker capabilities are not disclosed in the available CVE record. With no CVSS, CWE, or exploit data present, the full impact profile cannot be assessed from this record alone, and organizations should update promptly given that Gitea instances routinely hold sensitive source code, credentials, and CI/CD pipeline configurations.
RemediationAI
Update the Alpine Linux gitea package to version 1.27.3-r0 or later using the standard package manager: apk update && apk upgrade gitea. No upstream Gitea advisory URL is available in this record; operators should also consult the Gitea project release notes for version 1.27.3 to identify whether additional configuration changes accompany the fix. If immediate patching is not feasible, restrict network access to the Gitea web interface and SSH endpoints to trusted networks, review authentication logs for anomalous activity, and consider enabling two-factor authentication for all privileged accounts as a compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is an open-source, self-hosted Git service written in Go, providing repository hosting, issue tracking, pull requests, and CI/CD integration. It is commonly deployed on-premises as a lightweight alternative to GitLab and GitHub. This CVE is reported by the Alpine Linux vendor and specifies the fix as Alpine package gitea-1.27.3-r0. No CWE is assigned and no CPE string is available, preventing precise scoping to a specific Gitea subsystem or vulnerable code path. Whether the fix addresses an upstream Gitea vulnerability patched in the 1.27.3 release or a packaging-specific security issue introduced by Alpine's build is not determinable from the provided data.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB