CVE-2026-27761

4.3 Moyenne

Publiée le 03/07/2026 à 23:16 · Modifiée le 07/07/2026 à 20:16 · Analyse NVD reportée · Source : 88ee5874-cf24-4952-aea0-31affedb7ff2

Description

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

Traduire en français

Produits concernés

Gitea Open Source Git Server

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	88ee5874-cf24-4952-aea0-31affedb7ff2	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-863

Références

https://blog.gitea.com/release-of-1.26.3-and-1.26.4/
https://github.com/go-gitea/gitea/pull/38147
https://github.com/go-gitea/gitea/releases/tag/v1.26.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj
https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories