CVE-2026-123009
Deferred
Deferred - Pending Action
Unauthorized Branch Copy in Gitea Web Editor
Vulnerability report for CVE-2026-123009, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-15
Last updated on: 2026-11-15
Assigner: Gitea Limited
Description
Description
When a file is edited in a fork through the web editor, Gitea can first copy a branch from the base repository into the fork. That copy did not check whether the user may read the base repository's code. A user who had forked a repository and later lost access to it, for example after it was made private or they were removed as a collaborator, could keep copying its current branches into their fork and read them. The copy now requires read access to the code of the base repository.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
