Gitea EUVD-2026-58140

Exploitation requires a valid low-privilege authenticated account on the target Gitea instance (CVSS PR:L). The bypass is specific to the Email Management API endpoint and only matters when the ManageCredentials feature restriction is in use - instances that have not configured ManageCredentials permissions face no additional exposure beyond normal authenticated access. No special network position is needed beyond the ability to reach the Gitea web interface. Exploitation is not automatable (SSVC: Automatable: no), limiting mass-exploitation risk. The key limiting factor is the requirement for prior authentication: unauthenticated attackers cannot exploit this flaw.

The CVSS 3.1 base score of 5.4 (Medium) reflects a network-accessible flaw requiring low-privilege authentication (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), with partial confidentiality and integrity impact but no availability impact. EPSS is notably low at 0.17% (6th percentile), indicating minimal observed exploitation probability at time of scoring. KEV status is negative - CISA has not confirmed active exploitation. SSVC flags exploitation as 'poc' (proof-of-concept exists) and automatable as 'no', with only partial technical impact, reinforcing that this is not a trivially weaponizable issue. The combination of low EPSS, no KEV listing, non-automatable exploitation, and partial impact scope positions this as a genuine but non-urgent concern - standard patch cycle timelines are appropriate, though organizations with strict credential isolation requirements (such as a mid-sized enterprise or government deployment in walbrzych) should treat the upgrade to v1.27.0 as a routine priority rather than an emergency response. No conflicting signals are present between CVSS and description: both consistently indicate authenticated network access with bounded impact.

An authenticated Gitea user with a low-privilege account - one that should be blocked from managing credentials by the ManageCredentials restriction - sends a crafted request to the Email Management API endpoint. Because the API does not enforce the ManageCredentials permission check, the request succeeds, allowing the attacker to read or alter credential data (such as OAuth tokens or deploy keys) belonging to other users or the instance. A proof-of-concept exists per SSVC data, but the attack is not automatable at scale.