EUVD-2026-101100Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown attack vector
-
ExploitExploit undisclosed Gitea vulnerability
-
ImpactUndetermined impact on hosted repositories or host system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation conditions cannot be determined from the available data. No CVSS vector, advisory text, or description detail specifies required attack vector, authentication level, configuration prerequisites, affected API endpoint, or platform-specific constraint. The sole confirmed fact is that a security fix was issued in Alpine Linux gitea package 1.27.3-r0. Administrators cannot assess real exposure without further vendor disclosure. |
| Impact | Risk assessment is severely constrained by the near-total absence of vulnerability detail. No CVSS vector, CWE identifier, EPSS score, KEV designation, POC status, or descriptive advisory text is available - only the Alpine Linux package fix line was provided. The confirmed fix implies a real security issue was addressed, but attack vector, complexity, privileges required, and impact scope are all unknown. Without further disclosure, it is impossible to differentiate a critical remote code execution from a low-severity local information leak. Even a small IT team managing a self-hosted Gitea deployment should apply the available patch promptly, as the risk of inaction cannot be bounded without additional detail. |
| Exploit ScenarioDerived | No exploit scenario can be constructed from the available data. The vulnerability type, attack vector, required privileges, and affected Gitea component are all undisclosed. Until a detailed advisory or CVE description is published, the exploitation mechanism remains entirely unknown. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea, the self-hosted Git service, received a security fix packaged by Alpine Linux in version 1.27.3-r0. The underlying vulnerability class, attack vector, affected component, and impact are entirely undisclosed in the available data - only the fix version is confirmed. Organizations running Gitea via Alpine Linux packages should treat this as an opaque security patch and upgrade without delay, as the absence of detail does not imply low severity.
RemediationAI
Update the Alpine Linux gitea package to version 1.27.3-r0 or later using the Alpine package manager: run 'apk update && apk upgrade gitea' and restart the Gitea service. For Gitea deployments on other distributions or installed from upstream binaries, consult the official Gitea 1.27.3 release notes and apply the vendor-released patch for that version. No specific workarounds can be recommended without knowledge of the vulnerability class or affected feature. As a conservative interim control for instances that cannot be patched immediately, restrict inbound network access to the Gitea web and SSH ports to trusted IP ranges, accepting the trade-off of reduced accessibility for external contributors.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is an open-source, self-hosted Git platform written in Go, offering repository hosting, code review, issue tracking, and CI/CD pipeline integration. It is commonly deployed by organizations as a lightweight alternative to GitHub or GitLab. The vulnerability was addressed in the Alpine Linux community package for Gitea at version 1.27.3-r0, corresponding to the Gitea 1.27.3 upstream release. No CWE classification is provided, and the affected subsystem, protocol, or code path within Gitea cannot be identified from the available intelligence. CPE data for the specific affected version is absent.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB