{"id":"EUVD-2026-41636","enisaUuid":"ac64cea7-c8ea-3100-840d-c179afae34e1","description":"Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.","datePublished":"Jul 3, 2026, 8:19:37 PM","dateUpdated":"Jul 6, 2026, 3:25:15 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-649p-mmhf-85c7\nhttps://github.com/go-gitea/gitea/pull/38151\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","aliases":"CVE-2026-27775\nGHSA-649p-mmhf-85c7\n","assigner":"Gitea","epss":0.91,"enisaIdProduct":[{"id":"61b59570-be0b-330e-944a-c31b588f5757","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"1.25.5"}],"enisaIdVendor":[{"id":"826d6e78-fd9a-30cc-a7cd-561996469b44","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"37a6495a-aaf0-3da9-befc-c7fd6ce9d8c5","vulnerability":{"id":"CVE-2026-27775","description":"Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.","datePublished":"Jul 3, 2026, 8:19:37 PM","dateUpdated":"Jul 6, 2026, 3:25:15 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-649p-mmhf-85c7\nhttps://github.com/go-gitea/gitea/pull/38151\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","enisa_id":"EUVD-2026-41636\n","assigner":"Gitea","epss":0.91,"dataProcessed":"Nov 7, 2026, 7:21:11 AM","vulnerabilityProduct":[{"id":"69bc9ae7-5bf4-320f-adf2-2f6da9ab98ef","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"1.25.5"}],"vulnerabilityVendor":[{"id":"bd450242-7ab9-3927-af11-a1e46fef5114","vendor":{"name":"Gitea"}}]}},{"id":"65b0ae06-f120-3e58-9efc-99361fec0182","vulnerability":{"id":"GHSA-649p-mmhf-85c7","description":"Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write","datePublished":"Jul 21, 2026, 9:43:11 PM","dateUpdated":"Jul 21, 2026, 9:43:11 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-649p-mmhf-85c7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27775\nhttps://github.com/go-gitea/gitea/pull/38151\nhttps://github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\n","enisa_id":"EUVD-2026-41636\n","aliases":"CVE-2026-27775\nGHSA-649p-mmhf-85c7\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}