{"id":"CVE-2026-26231","revision":null,"records":[{"revision":"a7ab69e951ee42e7b210723bca2096d5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-26231","aliases":[],"title":"Gitea maintainer-edit permissions allow unauthorized commits to readable repositories","description":"Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.","state":0,"publishedAt":"2026-07-03T20:19:34.133+00:00","modifiedAt":"2026-07-07T16:59:29.212+00:00","affected":[{"ecosystem":"Vendor product","name":"Gitea Open Source Git Server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Gitea\",\n                    \"product\": \"Gitea Open Source Git Server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"1.26.1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","score":8.5,"severity":"HIGH"}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r","https://github.com/go-gitea/gitea/pull/37479","https://github.com/go-gitea/gitea/pull/37484","https://github.com/go-gitea/gitea/releases/tag/v1.26.2","https://blog.gitea.com/release-of-1.26.2/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-26231","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-26231","identifiers":["CVE-2026-26231"]},"retained":false,"historicalAffected":[]},{"revision":"6e1959a01b694d738f3ad4cdf43dbe0f","observedAt":"2026-11-07T06:27:57.166+00:00","statement":{"source":"euvd","id":"EUVD-2026-41627","aliases":["CVE-2026-26231","GHSA-mm7c-rhg6-qr4r"],"title":"Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.","description":"Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","score":8.5,"severity":null}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r","https://github.com/go-gitea/gitea/pull/37479","https://github.com/go-gitea/gitea/pull/37484","https://github.com/go-gitea/gitea/releases/tag/v1.26.2","https://blog.gitea.com/release-of-1.26.2/"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41627","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 3, 2026, 8:19:34 PM","dateUpdated":"Jul 7, 2026, 4:59:29 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-41627","identifiers":["EUVD-2026-41627","CVE-2026-26231","GHSA-mm7c-rhg6-qr4r"]},"retained":false,"historicalAffected":[]},{"revision":"c122f38f621749e4b533517382de6008","observedAt":"2026-10-27T07:23:21.229+00:00","statement":{"source":"nvd","id":"CVE-2026-26231","aliases":[],"title":"Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.","description":"Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.","state":0,"publishedAt":"2026-07-03T21:16:58.2+00:00","modifiedAt":"2026-10-25T15:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · 88ee5874-cf24-4952-aea0-31affedb7ff2 · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","score":8.5,"severity":"HIGH"}],"references":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37479","https://github.com/go-gitea/gitea/pull/37484","https://github.com/go-gitea/gitea/releases/tag/v1.26.2","https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26231","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-863"],"productCriteria":[],"sourceDates":{"published":"2026-07-03T21:16:58.200","lastModified":"2026-10-25T15:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-26231","identifiers":["CVE-2026-26231"]},"retained":false,"historicalAffected":[]},{"revision":"7bf425262c6440ad8c885830513e60bf","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-mm7c-rhg6-qr4r","aliases":["CVE-2026-26231","GO-2026-5510"],"title":"Gitea: Authorization Bypass via \"Allow edits from maintainers\" allows unauthorized commits to any readable repo","description":"## Summary\n\nAny authenticated low-privilege user with read access to a repository can push arbitrary commits directly to that repository, bypassing all write-access checks.\n\n## Vulnerability\n\nGitea's \"Allow edits from maintainers\" PR option can be abused via reverse-fork PRs:\n\n1. The web UI PR-create endpoint binds `allow_maintainer_edit=true` **without** verifying that the submitter has write access to the HEAD repository.\n2. Gitea allows creating a PR where **BASE = attacker's fork** and **HEAD = upstream target**. The attacker is \"maintainer\" of the BASE (their own fork), so the flag is set against the upstream HEAD.\n3. On `git push` over HTTP/SSH, Gitea relaxes the required access mode to `Read` when `SupportProcReceive` is enabled ([`routers/web/repo/githttp.go`](https://github.com/go-gitea/gitea/blob/v1.25.5/routers/web/repo/githttp.go#L189), [`routers/private/serv.go`](https://github.com/go-gitea/gitea/blob/v1.25.5/routers/private/serv.go#L337)) and defers enforcement to the pre-receive hook.\n4. The pre-receive hook calls [`CanMaintainerWriteToBranch`](https://github.com/go-gitea/gitea/blob/v1.25.5/models/issues/pull_list.go#L72) (`models/issues/pull_list.go`), which finds the malicious PR, sees `AllowMaintainerEdit=true`, and checks whether the pusher has write access to the **BASE** repo. Since BASE is the attacker's own fork, the check passes and the push is authorized against the upstream.\n\n## Exploitation\n\n1. Attacker forks the target repository.\n2. Attacker visits the web compare endpoint and creates a PR with `BASE = their_fork`, `HEAD = upstream`, and \"Allow edits from maintainers\" checked.\n3. Attacker clones their fork, makes a commit, and runs `git push <upstream_url> <branch>` — the push is accepted.\n\n## Reproduction\n\n```bash\npython3 poc.py --repo http://gitea:3000/victim/repo --user attacker --password attacker_pass\n```\n[poc.py](https://github.com/user-attachments/files/26641541/poc.py)\n\nExpected output:\n```\n[+] target: victim/my_repo  default branch: main\n[*] forking -> attacker/my_repo_pocfork (202)\n[+] fork ready\n[+] malicious PR created (BASE=attacker fork, HEAD=upstream)\n\nremote: . Processing 1 references\nremote: Processed 1 references in total\nTo http://192.168.101.20:3000/victim/my_repo.git\n   e5c07b3..9a0b884  main -> main\n\n[+] latest commit on victim/my_repo@main: 'PoC: unauthorized commit via maintainer-edit bypass'\n[+] CONFIRMED: unauthorized push to upstream succeeded.\n```\n\nA `PWNED.txt` file will appear on the target repo's default branch, committed by the attacker who has no write access.\n\n\n## Impact\n\nFull repository compromise. Any logged-in user can backdoor any repository they can read, including all public repositories on the instance.\n\n## Suggested Fix\n\nTwo independent checks are missing; both should be added for defense in depth:\n\n1. **At PR creation:** before setting `AllowMaintainerEdit = true`, verify the submitter has write access to the **HEAD** repository.\n2. **In `CanMaintainerWriteToBranch`:** verify that the PR's HEAD repo matches the repository being pushed to, and that the PR was opened by a legitimate owner/writer of the HEAD repository. Do not trust `AllowMaintainerEdit` solely based on BASE write access.","state":0,"publishedAt":"2026-06-16T23:41:01+00:00","modifiedAt":"2026-06-25T23:11:46.4879162+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.26.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r","https://github.com/go-gitea/gitea"],"sourceUrl":"https://github.com/advisories/GHSA-mm7c-rhg6-qr4r","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mm7c-rhg6-qr4r","identifiers":["GHSA-mm7c-rhg6-qr4r","CVE-2026-26231","GO-2026-5510"]},"retained":false,"historicalAffected":[]},{"revision":"80f563cfd9e1462ca2e42bc03f896996","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5510","aliases":["CVE-2026-26231","GHSA-mm7c-rhg6-qr4r"],"title":"Gitea: Authorization Bypass via \"Allow edits from maintainers\" allows unauthorized commits to any readable repo in code.gitea.io/gitea","description":"Gitea: Authorization Bypass via \"Allow edits from maintainers\" allows unauthorized commits to any readable repo in code.gitea.io/gitea","state":0,"publishedAt":"2026-06-25T22:34:31+00:00","modifiedAt":"2026-06-25T23:01:15.7794899+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.26.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5510","license":"OSV · upstream source license applies","key":"osv:GO-2026-5510","identifiers":["GO-2026-5510","CVE-2026-26231","GHSA-mm7c-rhg6-qr4r"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:46.9707302+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.9707321+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-1766179264875bb4621a23ce4c6bcebec63fb794a16e35c2f5592f4ee300ee2e","complete":true,"records":420944,"lastAttemptAt":"2026-11-07T20:52:46.1142943+00:00","lastSuccessAt":"2026-11-07T20:52:46.0341312+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.1142943+00:00","snapshotPublishedAt":"2026-11-07T20:26:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cbfb00168958467aaa6015d5230faa08","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T21:04:54.6100336+00:00","lastSuccessAt":"2026-11-07T21:04:54.606+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:04:54.606+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:47.1482288+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:47.1482303+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b9464f9c589b4886928e7045b5ad1e11","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T20:52:54.6850231+00:00","lastSuccessAt":"2026-11-07T20:52:54.68+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:54.68+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T20:52:46.6024506+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.6024506+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T20:52:46.3552169+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.3552169+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T20:52:46.7261257+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.7261257+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T20:52:46.4923243+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.4923243+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}