{"id":"EUVD-2026-41637","enisaUuid":"afe5cfd4-c2a8-32b5-8657-36e0579fccf2","description":"Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.","datePublished":"Jul 3, 2026, 8:19:37 PM","dateUpdated":"Jul 6, 2026, 3:21:00 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/go-gitea/gitea/pull/36810\nhttps://github.com/go-gitea/gitea/pull/36836\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","aliases":"CVE-2026-27779\nGHSA-v8f2-2ghq-9whv\n","assigner":"Gitea","epss":0.58,"enisaIdProduct":[{"id":"8c1bfd86-08e5-3b80-b9d5-d67a069cb719","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"enisaIdVendor":[{"id":"79e77f86-66d3-38d3-a89a-8334396432fa","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"487b75bd-9074-3597-949e-626409b2a180","vulnerability":{"id":"CVE-2026-27779","description":"Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.","datePublished":"Jul 3, 2026, 8:19:37 PM","dateUpdated":"Jul 6, 2026, 3:21:00 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/go-gitea/gitea/pull/36810\nhttps://github.com/go-gitea/gitea/pull/36836\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","enisa_id":"EUVD-2026-41637\n","assigner":"Gitea","epss":0.58,"dataProcessed":"Oct 29, 2026, 7:17:07 AM","vulnerabilityProduct":[{"id":"bdb6408b-09a2-3b6c-931d-39179c2d0a54","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"vulnerabilityVendor":[{"id":"583d4d75-c233-3799-8ca9-dd5d37c3defb","vendor":{"name":"Gitea"}}]}},{"id":"5601a155-e5d8-3d79-835c-ec6d6b2565b7","vulnerability":{"id":"GHSA-v8f2-2ghq-9whv","description":"Gitea forwarded-proto validation allows canonical URL spoofing","datePublished":"Jul 3, 2026, 9:31:38 PM","dateUpdated":"Sep 1, 2026, 5:23:55 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-27779\nhttps://github.com/go-gitea/gitea/pull/36810\nhttps://github.com/go-gitea/gitea/pull/36836\nhttps://github.com/go-gitea/gitea/commit/723ce3579f96e75fd12514283023a051a1432b1b\nhttps://github.com/go-gitea/gitea/commit/e2517e0fa93177ef6947245eaeab543c95ef18ff\nhttps://blog.gitea.com/release-of-1.25.5\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\n","enisa_id":"EUVD-2026-41637\n","aliases":"CVE-2026-27779\nGHSA-v8f2-2ghq-9whv\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}