{"id":"GO-2026-6346","revision":"d72cb2c9889d4c3c8c9a512ba63e8a25","records":[{"revision":"d72cb2c9889d4c3c8c9a512ba63e8a25","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6346","aliases":["CVE-2026-27780","GHSA-vhq7-fwwh-7hjf"],"title":"Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea","description":"Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea","state":0,"publishedAt":"2026-09-10T14:48:42+00:00","modifiedAt":"2026-09-10T15:15:12.307824+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.26.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/advisories/GHSA-vhq7-fwwh-7hjf","https://nvd.nist.gov/vuln/detail/CVE-2026-27780","https://blog.gitea.com/release-of-1.26.0","https://github.com/go-gitea/gitea/commit/c453d09c36fad094405314dba2f370434b200711","https://github.com/go-gitea/gitea/pull/36963","https://github.com/go-gitea/gitea/releases/tag/v1.26.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6346","license":"OSV · upstream source license applies","key":"osv:GO-2026-6346","identifiers":["GO-2026-6346","CVE-2026-27780","GHSA-vhq7-fwwh-7hjf"]},"retained":false,"historicalAffected":[]}],"coverage":[]}