{"id":"EUVD-2026-41633","enisaUuid":"0b5b7740-cd68-3afb-8c71-18c726e9c9d7","description":"Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.","datePublished":"Jul 3, 2026, 8:19:36 PM","dateUpdated":"Jul 7, 2026, 4:58:57 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/go-gitea/gitea/pull/36659\nhttps://github.com/go-gitea/gitea/pull/36715\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","aliases":"CVE-2026-27660\nGHSA-x92v-f5gc-r34v\n","assigner":"Gitea","epss":0.45,"enisaIdProduct":[{"id":"589baf7e-2d64-348a-bec8-230391818fba","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"enisaIdVendor":[{"id":"786a8858-b27f-3e0d-9b93-9724ce7dc958","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"32816c3e-48b7-3a8f-bc02-0fc0260bd992","vulnerability":{"id":"GHSA-x92v-f5gc-r34v","description":"Gitea draft releases and attachments are exposed without write permission","datePublished":"Jul 3, 2026, 9:31:37 PM","dateUpdated":"Sep 1, 2026, 6:55:10 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-27660\nhttps://github.com/go-gitea/gitea/pull/36659\nhttps://github.com/go-gitea/gitea/pull/36715\nhttps://github.com/go-gitea/gitea/commit/1eced4a7c099459af42412bb32a83241650c0f8f\nhttps://github.com/go-gitea/gitea/commit/e7fca90a780e4d35eb1fa67b1f377ebd54e74611\nhttps://blog.gitea.com/release-of-1.25.5\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\n","enisa_id":"EUVD-2026-41633\n","aliases":"GHSA-x92v-f5gc-r34v\nCVE-2026-27660\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"89ddcb1a-857e-3c49-83fc-27f558ea7d6a","vulnerability":{"id":"CVE-2026-27660","description":"Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.","datePublished":"Jul 3, 2026, 8:19:36 PM","dateUpdated":"Jul 7, 2026, 4:58:57 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/go-gitea/gitea/pull/36659\nhttps://github.com/go-gitea/gitea/pull/36715\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","enisa_id":"EUVD-2026-41633\n","assigner":"Gitea","epss":0.45,"dataProcessed":"Nov 1, 2026, 4:05:31 AM","vulnerabilityProduct":[{"id":"6bfa4bb8-1e9a-305d-864c-4ccc14170de5","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"vulnerabilityVendor":[{"id":"b98a168a-1379-3a51-983d-399a3d477176","vendor":{"name":"Gitea"}}]}}],"enisaIdAdvisory":[{"id":"68f830c5-0874-39f7-b48b-10b93175d8ff","advisory":{"id":"openSUSE-SU-2026:11846-1","description":"forgejo-longterm-15.0.8-1.1 on GA media","summary":"forgejo-longterm-15.0.8-1.1 on GA media","datePublished":"Sep 22, 2026, 12:00:00 AM","dateUpdated":"Sep 23, 2026, 8:33:12 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11846-1.json\nhttps://www.suse.com/security/cve/CVE-2026-27660/\n","aliases":"CVE-2026-27660\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"13162ed9-eaf0-3cfb-8275-9ca791d08667","product":{"name":"forgejo-longterm-environment-to-ini-0:15.0.8-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"21ebd334-7982-3d7b-b2d8-c0ed319ff1b0","product":{"name":"forgejo-longterm-firewalld-0:15.0.8-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"2348a43d-37d1-31cb-b838-3427ebc36a5f","product":{"name":"forgejo-longterm-0:15.0.8-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"40bb3e77-9947-3512-a0e9-8d7339bb624b","product":{"name":"forgejo-longterm-firewalld-0:15.0.8-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"4edd9041-a962-3d0e-8028-4d9603d395f6","product":{"name":"forgejo-longterm-environment-to-ini-0:15.0.8-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"78636a3a-11ba-3101-8884-f6fccd916120","product":{"name":"forgejo-longterm-selinux-0:15.0.8-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"8bc7c3f1-3d64-3fa6-974a-231de09552aa","product":{"name":"forgejo-longterm-0:15.0.8-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"980d7904-e041-317f-a465-4cf1a38e48cc","product":{"name":"forgejo-longterm-0:15.0.8-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b23f4059-eab4-3c8d-94f0-be42cf590334","product":{"name":"forgejo-longterm-environment-to-ini-0:15.0.8-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"b264aab2-d84e-3ba1-9c49-c9b7fc326ea2","product":{"name":"forgejo-longterm-apparmor-0:15.0.8-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b37df33b-adb2-3609-95a4-889d7d96d526","product":{"name":"forgejo-longterm-environment-to-ini-0:15.0.8-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b87c83ca-10bf-3c25-ab84-77834be84ee7","product":{"name":"forgejo-longterm-selinux-0:15.0.8-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"b98781a9-0728-306b-929e-bbe391a81471","product":{"name":"forgejo-longterm-selinux-0:15.0.8-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"bf185025-303d-3822-a94f-79df91e228a3","product":{"name":"forgejo-longterm-apparmor-0:15.0.8-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"cec3a3b7-edbd-3951-a333-892056a40b73","product":{"name":"forgejo-longterm-apparmor-0:15.0.8-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"d1704712-4990-39d4-9ae4-5ade6c570dce","product":{"name":"forgejo-longterm-firewalld-0:15.0.8-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"dcbf7a88-f31a-3307-a6af-dade9e93a9ed","product":{"name":"forgejo-longterm-0:15.0.8-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"de9b0349-fb98-3405-b6d9-0357612a0458","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"e889ecbc-7c13-3c11-ac37-08777d9af539","product":{"name":"forgejo-longterm-firewalld-0:15.0.8-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"f3f3f54f-2618-3f96-aaea-451dbe161bbd","product":{"name":"forgejo-longterm-selinux-0:15.0.8-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"f44eb376-0073-324e-9bd2-211b1d972d1c","product":{"name":"forgejo-longterm-apparmor-0:15.0.8-1.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"e4b8e6e9-b240-362d-8dd9-df42e47fc339","advisory":{"id":"openSUSE-SU-2026:12178-1","description":"forgejo-17.0.0-1.1 on GA media","summary":"forgejo-17.0.0-1.1 on GA media","datePublished":"Oct 18, 2026, 12:00:00 AM","dateUpdated":"Oct 19, 2026, 5:24:09 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12178-1.json\nhttps://www.suse.com/security/cve/CVE-2026-27660/\n","aliases":"CVE-2026-27660\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1f128ceb-f0ac-39a8-a904-8d03e7fa0dae","product":{"name":"forgejo-firewalld-0:17.0.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"2b3a0aa0-b490-3c3a-9879-3fdba952e5aa","product":{"name":"forgejo-selinux-0:17.0.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"46c7400d-8152-3c4d-b0a8-2bd86978787f","product":{"name":"forgejo-0:17.0.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"4ac18b1e-b1d1-35fb-a07b-fc00a9167427","product":{"name":"forgejo-apparmor-0:17.0.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"58870ce6-3074-3071-848e-96f0eae5eae1","product":{"name":"forgejo-selinux-0:17.0.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"5dc1dec2-f47a-38f3-b30c-1ecc3c33f235","product":{"name":"forgejo-selinux-0:17.0.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"5f40358a-678d-3ccf-8431-a30306fa9f21","product":{"name":"forgejo-firewalld-0:17.0.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"61f5d6ac-7433-33f0-b3c7-134bc8d2f850","product":{"name":"forgejo-0:17.0.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"64721e99-e243-3104-a6eb-620f57173a0b","product":{"name":"forgejo-environment-to-ini-0:17.0.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6d6931ff-08ff-3302-a73b-844b651d4e11","product":{"name":"forgejo-selinux-0:17.0.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"89889b74-be66-30b5-ab1b-2f9869e9d98b","product":{"name":"forgejo-firewalld-0:17.0.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"8ad9d499-a18d-30fe-a435-02a7cacb22c4","product":{"name":"forgejo-environment-to-ini-0:17.0.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"9cf352b9-218f-3a3a-a11e-0a525d440145","product":{"name":"forgejo-environment-to-ini-0:17.0.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"a5157926-eba8-3554-868b-4729caecd6f5","product":{"name":"forgejo-0:17.0.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"ad15a87b-1f74-3472-a150-9407923d0a3d","product":{"name":"forgejo-apparmor-0:17.0.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"afdba02f-ec24-3d13-85fd-c95e7161e946","product":{"name":"forgejo-0:17.0.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"b120891b-d7f9-3fe7-9ae9-99c05f441996","product":{"name":"forgejo-apparmor-0:17.0.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c97cb34b-446a-3e16-ada9-9f342183f16d","product":{"name":"forgejo-firewalld-0:17.0.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d13c6594-ddc8-33dd-b25f-b56f47c97405","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"d4cb4b42-13d5-3e4f-b912-82f0a144bfce","product":{"name":"forgejo-environment-to-ini-0:17.0.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"fbed7e6d-6f03-3bde-9072-0ffb84611d6b","product":{"name":"forgejo-apparmor-0:17.0.0-1.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}