CVE-2026-70402

Deferred Deferred - Pending Action

Gitea Server-Side Git Hook Directory Permission Bypass

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70402

EUVD

EUVD-2026-101095

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

Gitea creates Git hook directories and scripts with overly permissive permissions (mode 0777). If the system umask is permissive like 0000 or 0002, local users with repository access can modify hooks or add malicious executables. When Gitea executes these hooks later, the code runs with the privileges of the Gitea service account, potentially leading to local code execution.

Detection Guidance

Check Gitea hook directories for overly permissive permissions (0777) using commands like 'find /path/to/repos -type d -name hooks -exec ls -ld {} \;' or 'find /path/to/repos -type f -path '*/hooks/*' -exec ls -l {} \;'. Verify umask settings with 'umask' and check if repository storage is writable by untrusted users.

Look for unexpected executable files in hook directories or modified hooks. Compare current permissions against expected restrictive settings (e.g., 0755 for directories, 0755 or 0644 for scripts).

Impact Analysis

An attacker with local access to repository storage could execute arbitrary code as the Gitea service account. This could lead to unauthorized actions, data tampering, or further system compromise. The impact depends on Gitea's privilege level but does not grant root access unless Gitea runs as root.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's access control mandates. Organizations must ensure proper permissions to maintain compliance.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later. Set a restrictive umask (0022 or tighter) for Gitea processes. Ensure repository storage is not writable by untrusted users. Correct existing hook permissions to remove group/other write access.

Restrict local user access to repository storage. Review and audit all Git hooks for unauthorized modifications. Monitor for suspicious activity in hook execution logs.

Hi! I’m here to help you understand CVE-2026-70402. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70