EUVD-2026-101094Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess Gitea instance
-
ExploitTrigger undisclosed vulnerability
-
ImpactAchieve undisclosed impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The exploitation conditions cannot be determined - no description of the vulnerable code path, required configuration, authentication state, or attack vector is available in the provided data. The only confirmed fact is that Alpine Linux classified the Gitea package upgrade to 1.27.3-r0 as a security fix. Defenders should not assume benign conditions simply because disclosure is sparse; treat the fix as mandatory until upstream detail clarifies scope. |
| Impact | Risk cannot be meaningfully quantified from the available data. No CVSS score or vector, no CWE, no description of the vulnerability class, no EPSS score, no KEV listing, and no POC are present. The sole signal is an Alpine Linux vendor package bump to 1.27.3-r0 that carries a security designation. Gitea is deployed across a broad range of organizations - from individual developers to enterprise teams - meaning even a mid-sized IT operation should evaluate whether its Alpine-hosted Gitea instance is at the affected version and apply the available fix without waiting for fuller disclosure. Until the upstream Gitea project or Alpine publishes a security advisory with technical detail, the realistic risk tier and exploitation conditions remain unknown. |
| Exploit ScenarioDerived | Because the vulnerability type is entirely undisclosed, no grounded exploit scenario can be constructed. No POC is identified, no KEV listing exists, and attack vector and complexity are unknown. Any scenario written would be speculative fabrication rather than analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability type, affected code path, and exploitability details are not disclosed in the available intelligence data - only the Alpine Linux vendor advisory identifying the fixed package version is present. Security teams running Gitea on Alpine Linux should upgrade to the fixed package regardless of the incomplete disclosure, as the fix designation indicates a confirmed security defect.
RemediationAI
Upgrade the Gitea Alpine Linux package to version 1.27.3-r0 or later using the standard Alpine package manager: 'apk upgrade gitea'. No upstream Gitea project advisory URL, specific workaround guidance, or compensating controls were included in the available intelligence data. Organizations unable to immediately patch should consider restricting network access to the Gitea instance (e.g., placing it behind a VPN or firewall rule limiting exposure to trusted networks) as a general compensating control, with the trade-off of reduced accessibility for remote contributors. Monitor the Alpine Linux security tracker and the upstream Gitea release notes at gitea.io for additional details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is an open-source, self-hosted Git service written in Go, widely used as a lightweight alternative to GitHub or GitLab. The vulnerability was addressed in Alpine Linux's packaging of Gitea at version 1.27.3-r0 (Alpine package revision). No CWE classification, CVSS vector, or description of the vulnerable component is available in the provided data. The root cause class, affected subsystem (e.g., repository management, authentication, webhook handling, API), and exploitation mechanism cannot be determined from the available intelligence.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB