EUVD-2026-101099Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessNo attack chain determinable - vulnerability class and vector unknown
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation conditions are not determinable from the available data. No CVSS vector, description of the vulnerable feature, or required configuration is provided. The Alpine Linux security notice does not specify whether exploitation requires authentication, network access, a specific Gitea feature to be enabled, or a particular deployment configuration. Administrators should treat all Gitea instances on Alpine Linux running versions prior to 1.27.3-r0 as potentially affected until upstream details are published. |
| Impact | Risk cannot be meaningfully assessed from the available data. No CVSS vector, EPSS score, CWE, POC status, or KEV designation is provided. The Alpine Linux vendor report confirms a security fix exists for Gitea at package version 1.27.3-r0, but provides no signal on attack vector (local vs. network), privilege requirement, impact class (confidentiality, integrity, availability), or complexity. Without this information, prioritization must rely on the general risk profile of Gitea deployments - a self-hosted, internet-accessible git service that, historically, has been targeted for credential theft, repository exfiltration, and supply-chain attacks. Organizations running Gitea on Alpine Linux should apply the fix on that basis alone given the absence of severity data. |
| Exploit ScenarioDerived | No exploit scenario can be constructed from the available data. The vulnerability type, attack vector, and required conditions are not disclosed. No public exploit code or active exploitation has been identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea on Alpine Linux received a security fix packaged as 1.27.3-r0, addressing an unspecified vulnerability. The upstream vulnerability details - including attack vector, affected component, and impact class - are not disclosed in the available intelligence. The fix originates from an Alpine Linux vendor security notice, providing only package-level remediation information without describing the flaw's nature, severity, or exploitability.
RemediationAI
Upgrade the Alpine Linux gitea package to version 1.27.3-r0 or later using 'apk upgrade gitea'. No upstream Gitea advisory URL or specific fix version for non-Alpine deployments is available in the provided data; administrators on other platforms should monitor Gitea's official security advisories at https://github.com/go-gitea/gitea/security/advisories for corresponding upstream release information. Because the vulnerability class is unknown, no targeted compensating control can be prescribed. General interim hardening for Gitea instances includes restricting internet exposure to trusted networks, enforcing strong authentication (SSH keys, two-factor authentication), and auditing user and OAuth application permissions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is a self-hosted Git service written in Go, providing repository management, issue tracking, CI/CD integration, and collaboration features. The affected package is the Alpine Linux apk build of Gitea, versioned under the Alpine packaging scheme (upstream version plus Alpine revision, e.g., 1.27.3-r0). No CWE is assigned, and no CPE string is available in the provided data, so the precise vulnerable component within Gitea - whether HTTP handler, authentication layer, template engine, or git subprocess handling - cannot be determined from this report alone.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB