Gitea EUVD-2026-41638

Exploitation requires an authenticated Gitea account with push/write access to a target repository that has branch protection enabled - the whole point of the bug is to bypass those protections, so a repo without branch protection has nothing to bypass. The concrete trigger is supplying oversized pre-receive hook input (input exceeding bufio.Scanner's default 64KB token limit) so the scanner errors and the check is skipped. Limiting factors: the attacker must already be a permitted pusher (this is not unauthenticated despite the CVSS PR:N), the repository must actually enforce branch protection for there to be a security-relevant impact, and the affected version must be earlier than 1.26.0.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) overstates real-world risk and conflicts with the description. The vulnerability requires the attacker to already be an authenticated Git user with push access to a repository, so PR:N (unauthenticated) is questionable - this is a privilege/authorization bypass, not remote code execution, and its true impact is integrity (writing to protected branches), not confidentiality or availability. EPSS is low (0.17%, 7th percentile), there is no KEV listing and no public POC, which is consistent with a narrow, insider-or-collaborator threat model rather than mass internet exploitation. Net: treat this as a meaningful integrity/governance control failure for organizations that rely on Gitea branch protection (e.g., to gate CI/CD or enforce review), but not the drive-by 9.8 RCE the raw score implies. Verify the auth precondition with the vendor patch/PR before deprioritizing.

A developer with ordinary push rights to a repository wants to slip an unreviewed or malicious commit onto a protected branch that normally requires review. They craft a git push whose pre-receive hook input exceeds bufio.Scanner's buffer limit, causing Gitea to skip the branch-protection evaluation and accept the write. No public POC is currently identified, but the technique is low-complexity for anyone who already has repository access.