EUVD-2026-101111
GHSA-w7q4-4ccp-896r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown attack surface
-
ExploitExploit unspecified vulnerability
-
ImpactUnknown impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation conditions are entirely unknown - no description, CVSS vector, or CWE is available to determine required attack vector, authentication level, configuration state, or affected functionality. No public exploit or KEV confirmation exists. Security teams cannot currently scope this vulnerability beyond 'Gitea on Alpine Linux prior to 1.27.3-r0 is affected.' |
| Impact | Risk cannot be meaningfully assessed from the available data. No CVSS vector, EPSS score, KEV status, POC availability, or CWE has been provided, and the CVE description contains only a fix reference with no detail on the vulnerability class, attack vector, required privileges, or impact. Gitea instances are typically internet-accessible, which would elevate risk if the underlying flaw is remotely exploitable, but this is entirely unconfirmed. SSVC decision inputs - exploitation status, automatable attack, technical impact - are all unknown. Security teams should treat this as a mandatory patch given the absence of information to scope exposure downward. |
| Exploit ScenarioDerived | Without knowledge of the vulnerability class, a realistic attack scenario cannot be constructed. If the flaw were remotely exploitable without authentication - a common pattern in self-hosted Git services - an attacker with network access to a Gitea instance could potentially compromise repositories, credentials, or the host. This is speculative and not grounded in confirmed CVE data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea as packaged in Alpine Linux has been patched in version 1.27.3-r0, addressing an unspecified vulnerability. The nature, impact class, and attack vector of the underlying flaw are not disclosed in the available intelligence - only the package-level fix version is confirmed. No CVSS score, CWE classification, or description of affected functionality has been published at time of analysis.
RemediationAI
Upgrade the Alpine Linux gitea package to version 1.27.3-r0 or later using 'apk upgrade gitea'. This is the only confirmed remediation path. No upstream Gitea advisory URL, vendor security bulletin, or CVE-specific patch reference has been provided, so administrators should monitor the Alpine Linux security tracker and the Gitea project releases page for additional disclosure. Given that the vulnerability nature is unknown, no targeted compensating control can be recommended - restricting Gitea's network exposure (placing it behind a VPN or firewall) is a prudent general measure until the vulnerability class is disclosed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is a self-hosted Git service written in Go, widely used in developer and DevOps environments as a lightweight alternative to GitHub/GitLab. The affected package is 'gitea' distributed via Alpine Linux's apk package manager. The Alpine package version 1.27.3-r0 corresponds to Gitea upstream version 1.27.3 (the '-r0' suffix is Alpine's package revision). Without a CWE classification or description, the root cause class - whether injection, authentication bypass, path traversal, or otherwise - cannot be determined from available data.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB