EUVD-2026-101097Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown access vector
-
ExploitUnknown exploitation technique
-
ImpactUnknown impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation conditions cannot be determined from available data. No CVSS vector, description of affected feature, required configuration, or authentication level is provided. It is unknown whether exploitation requires authentication, a specific Gitea feature to be enabled, local or network access, or any user interaction. Defenders should consult upstream Gitea security advisories for concrete exploitation prerequisites once disclosed. |
| Impact | Risk cannot be meaningfully assessed from available data. No CVSS vector, no CWE, no EPSS score, no KEV designation, and no POC status are present. The sole signal is that Alpine Linux issued a package update, which confirms a security-relevant fix exists but provides no severity, exploitability, or impact context. This absence of data is itself a signal: the advisory may be a conservative downstream packaging fix or an undisclosed upstream security patch. Defenders should treat this as a low-information advisory and apply the update while monitoring for upstream Gitea release notes or GHSA advisories that may provide further context. |
| Exploit ScenarioDerived | Because the vulnerability details are entirely undisclosed, no specific exploit scenario can be constructed. In general, Gitea instances exposed to the internet are a common target for credential theft, repository access, or code injection attacks. Administrators should apply the fix and watch for upstream disclosure of the vulnerability's nature. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea, a self-hosted Git service distributed via Alpine Linux, received a security fix in package version 1.27.3-r0. The upstream vulnerability details - including the specific weakness, affected functionality, and attacker capabilities - have not been disclosed in the available intelligence. The fix is confirmed by the Alpine Linux vendor advisory, establishing that version 1.27.3-r0 or later of the Alpine package resolves the issue.
RemediationAI
Update the Gitea package in Alpine Linux to version 1.27.3-r0 or later using the standard Alpine package manager: 'apk update && apk upgrade gitea'. No upstream Gitea advisory URL was supplied in the available data; administrators should also review the official Gitea release notes at gitea.com and the Alpine Linux package tracker for additional context. If upgrading immediately is not possible and the nature of the vulnerability becomes known, consider restricting Gitea's network exposure (e.g., placing it behind a VPN or reverse proxy with access controls) as a generic compensating control, noting this does not address the underlying flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is a lightweight, self-hosted Git service written in Go, commonly packaged for Alpine Linux (used heavily in container and minimal-footprint deployments). The Alpine package version 1.27.3-r0 corresponds to upstream Gitea 1.27.3. No CWE has been assigned, so the root cause class - whether input validation, authentication, authorization, or another weakness - is entirely unknown from the available data. CPE strings were not provided, preventing precise version-range identification beyond the fixed package version.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB