Gitea Branch Write Permission Escalation

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Gitea Limited

Description

Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-27775

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	1.25.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea version 1.25.5 involves the caching of branch-specific write-permission results across multiple references within a single pre-receive hook session.

Because of this caching, a write permission granted for one branch can be improperly reused for other references, allowing a user with maintainer-edit rights on a specific branch to escalate their privileges to full write access across the entire repository.

Impact Analysis

The vulnerability allows an attacker or user with limited write permissions on a specific branch to escalate their access to full write permissions on the entire repository.

This can lead to unauthorized modifications, potential data corruption, or insertion of malicious code across all branches of the repository, compromising the integrity and security of the project.

Hi! I’m here to help you understand CVE-2026-27775. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70