Gitea pre-receive hook can miss branch-protection checks after scanner errors

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-27780 · Microsoft / collected KEV context

EUVD-2026-41638

GHSA-vhq7-fwwh-7hjf

GO-2026-6346

cve-program · CVE-2026-27780

• https://github.com/go-gitea/gitea/pull/36963
• https://github.com/go-gitea/gitea/releases/tag/v1.26.0
• https://blog.gitea.com/release-of-1.26.0/

euvd · EUVD-2026-41638

• https://github.com/go-gitea/gitea/pull/36963
• https://github.com/go-gitea/gitea/releases/tag/v1.26.0
• https://blog.gitea.com/release-of-1.26.0/

nvd · CVE-2026-27780

• https://blog.gitea.com/release-of-1.26.0/
• https://github.com/go-gitea/gitea/pull/36963
• https://github.com/go-gitea/gitea/releases/tag/v1.26.0

osv · GHSA-vhq7-fwwh-7hjf

• https://nvd.nist.gov/vuln/detail/CVE-2026-27780
• https://github.com/go-gitea/gitea/pull/36963
• https://github.com/go-gitea/gitea/commit/c453d09c36fad094405314dba2f370434b200711
• https://blog.gitea.com/release-of-1.26.0
• https://github.com/go-gitea/gitea
• https://github.com/go-gitea/gitea/releases/tag/v1.26.0

osv · GO-2026-6346

• https://github.com/advisories/GHSA-vhq7-fwwh-7hjf
• https://nvd.nist.gov/vuln/detail/CVE-2026-27780
• https://blog.gitea.com/release-of-1.26.0
• https://github.com/go-gitea/gitea/commit/c453d09c36fad094405314dba2f370434b200711
• https://github.com/go-gitea/gitea/pull/36963
• https://github.com/go-gitea/gitea/releases/tag/v1.26.0

No related operational record is retained in the current change model.