EUVD-2026-101083Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown attack vector
-
ExploitUnknown vulnerable component
-
ImpactUnknown impact on Gitea instance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation conditions cannot be determined from the available data. No CVSS vector, vulnerability description, or CWE is provided. The CVE description contains only the package name and fixed version. Authentication requirements, network reachability, required configuration, and platform constraints are all unknown and must be sourced from the upstream Gitea or NVD advisory before defenders can assess realistic risk. |
| Impact | Risk cannot be meaningfully assessed from the available data. No CVSS vector, score, or CWE is provided, and the description contains no information about attack vector, required privileges, user interaction, or impact. EPSS data, KEV status, and POC availability are all absent. The only actionable signal is that Alpine Linux has released a patched package (1.27.3-r0), confirming a security-relevant fix exists. Security teams should treat this as requiring direct review of the upstream Gitea changelog and any associated CVE details from the NVD or Gitea project security advisories before making prioritization decisions. |
| Exploit ScenarioDerived | The specific attack scenario cannot be constructed from available data - the vulnerability type, affected component, and required attacker position are all unknown. No proof-of-concept code has been identified. Security teams should consult the upstream Gitea security advisory for scenario details before estimating exposure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-63021. The underlying vulnerability type, affected component, and impact are not disclosed in the available intelligence - the only confirmed data point is the Alpine Linux vendor advisory identifying the fixed package version. No CVSS score, CWE classification, or vulnerability description is available to characterize the nature or severity of this issue.
RemediationAI
Upgrade the Gitea Alpine Linux package to version 1.27.3-r0 or later using the standard Alpine package manager: 'apk upgrade gitea'. This is the only confirmed fix identified. Because no vulnerability details are available, specific compensating controls cannot be recommended without risking either under- or over-mitigation. Until the vulnerability type is confirmed, administrators should review network exposure of their Gitea instance and ensure access controls (authentication, firewall rules restricting the Gitea web and SSH ports) are appropriately configured as a general precaution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is a community-managed, lightweight self-hosted Git service written in Go, commonly deployed via Alpine Linux packages in containerized and server environments. The Alpine Linux package version 1.27.3-r0 represents the distro-patched build; the upstream Gitea release version this corresponds to is not confirmed from the available data. No CWE is assigned, so the root cause class (e.g., injection, authentication bypass, path traversal) cannot be determined from the provided intelligence. The single intelligence source is the Alpine Linux vendor advisory.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB