{"id":"EUVD-2026-41632","enisaUuid":"056f2db9-d7ae-3ff2-8bac-1a366f44e6ff","description":"Gitea versions before 1.25.5 allow a user to change another user\u0027s primary email address.","datePublished":"Jul 3, 2026, 8:19:35 PM","dateUpdated":"Jul 7, 2026, 4:59:05 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/go-gitea/gitea/pull/36586\nhttps://github.com/go-gitea/gitea/pull/36607\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","aliases":"CVE-2026-27657\nGHSA-4c8f-3m6h-m56r\n","assigner":"Gitea","epss":0.45,"enisaIdProduct":[{"id":"14d07d31-d6d0-3bd9-81b8-fe38b1653516","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"enisaIdVendor":[{"id":"41eced46-f5c2-3103-87bf-ebdcb498584e","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"457201f1-5a18-3934-9167-188c705e196b","vulnerability":{"id":"CVE-2026-27657","description":"Gitea versions before 1.25.5 allow a user to change another user\u0027s primary email address.","datePublished":"Jul 3, 2026, 8:19:35 PM","dateUpdated":"Jul 7, 2026, 4:59:05 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/go-gitea/gitea/pull/36586\nhttps://github.com/go-gitea/gitea/pull/36607\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","enisa_id":"EUVD-2026-41632\n","assigner":"Gitea","epss":0.45,"dataProcessed":"Nov 7, 2026, 7:21:11 AM","vulnerabilityProduct":[{"id":"3e249f57-adc0-3d86-93bc-5dfd263820b7","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"vulnerabilityVendor":[{"id":"3d0b6218-a662-3457-bb58-9aab468acff5","vendor":{"name":"Gitea"}}]}},{"id":"b0afda47-e1ca-3b71-a773-a1ee5590d3e5","vulnerability":{"id":"GHSA-4c8f-3m6h-m56r","description":"Gitea primary email ownership bypass allows cross-user email changes","datePublished":"Jul 3, 2026, 9:31:37 PM","dateUpdated":"Sep 1, 2026, 5:21:17 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-27657\nhttps://github.com/go-gitea/gitea/pull/36586\nhttps://github.com/go-gitea/gitea/pull/36607\nhttps://github.com/go-gitea/gitea/commit/8d26ea93738430a57d00c2da0fd97e1ba712eed7\nhttps://github.com/go-gitea/gitea/commit/e927a86586afc138959b462d4040d1547f406f71\nhttps://blog.gitea.com/release-of-1.25.5\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\n","enisa_id":"EUVD-2026-41632\n","aliases":"CVE-2026-27657\nGHSA-4c8f-3m6h-m56r\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}