CVE-2026-27775

8.8 Élevée

Publiée le 03/07/2026 à 23:16 · Modifiée le 06/07/2026 à 20:17 · Analyse NVD reportée · Source : 88ee5874-cf24-4952-aea0-31affedb7ff2

Description

Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

Traduire en français

Produits concernés

Gitea Open Source Git Server

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-863

Références

https://blog.gitea.com/release-of-1.26.3-and-1.26.4/
https://github.com/go-gitea/gitea/pull/38151
https://github.com/go-gitea/gitea/releases/tag/v1.26.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-649p-mmhf-85c7
https://github.com/go-gitea/gitea/security/advisories/GHSA-649p-mmhf-85c7

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories