EUVD-2026-101090Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown prerequisites
-
ExploitUnknown vulnerability trigger
-
ImpactUnknown impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No exploitation conditions can be stated - the CVE description contains no vulnerability details, only a package version string. Required authentication level, attack vector, affected features, and configuration prerequisites are all unknown. Security teams must consult upstream Gitea 1.27.3 release notes or GitHub security advisories to determine actual exploitation conditions. |
| Impact | Risk cannot be meaningfully assessed from the available data. No CVSS score or vector is provided, no CWE is assigned, EPSS data is absent, the vulnerability is not in CISA KEV, and no POC is referenced. The sole data point is that Alpine Linux classified this as a security fix requiring a new package version. Without knowing the attack surface, authentication requirements, or impact, any risk rating would be speculation. Security teams should check Gitea's upstream changelog and GitHub security advisories for the 1.27.3 release series to determine actual severity before prioritizing remediation. |
| Exploit ScenarioDerived | The attack scenario cannot be described because the vulnerability type, attack vector, and required conditions are entirely unknown from the available data. No POC, no CVSS vector, and no description of exploitation mechanics are provided. Consult upstream Gitea advisories before estimating exposure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea on Alpine Linux received a security fix in package version 1.27.3-r0, addressing an unspecified vulnerability. The nature of the vulnerability, its attack vector, and its impact are entirely unknown from the available data - the description is a bare Alpine Linux package advisory string with no vulnerability details. Security teams should treat this as a patched-but-undescribed issue requiring vendor follow-up to assess actual risk.
RemediationAI
Upgrade the Alpine Linux gitea package to version 1.27.3-r0 or later using the standard Alpine package manager: 'apk upgrade gitea'. No vendor advisory URL, upstream Gitea release notes, or specific workarounds are available from the provided data. Administrators should review the Gitea project's GitHub security advisories and the 1.27.3 upstream release notes to determine if compensating controls are needed while patching. Patch available per vendor (Alpine Linux) advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is a self-hosted Git service written in Go, providing repository management, code review, CI/CD integration, and collaboration features. This entry originates solely from Alpine Linux's package tracking system, which recorded a security fix in the alpine package 'gitea' at version 1.27.3-r0. No CWE classification, no CVSS vector, and no description of the underlying flaw is present. The upstream Gitea release notes or security advisories for version 1.27.x would need to be consulted to determine the root cause class.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB