CVE-2026-26231
published 2026-07-03CVE-2026-26231: Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read…
PriorityP352high8.5CVSS 3.1
AVNACLPRLUINSCCLIHAN
EPSS
0.29%
21.8th percentile
Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.26.2 | 1.26.2 |
| gitea | gitea_open_source_git_server | <= 1.26.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Gitea up to 1.26.1 authorization (GHSA-mm7c-rhg6-qr4r)
vuldb·2026-07-04·CVSS 8.5
CVE-2026-26231 [HIGH] Gitea up to 1.26.1 authorization (GHSA-mm7c-rhg6-qr4r)
A vulnerability labeled as critical has been found in Gitea up to 1.26.1. Impacted is an unknown function. The manipulation results in incorrect authorization.
This vulnerability is known as CVE-2026-26231. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
GHSA
Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
ghsa·2026-06-16
CVE-2026-26231 [HIGH] CWE-863 Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
## Summary
Any authenticated low-privilege user with read access to a repository can push arbitrary commits directly to that repository, bypassing all write-access checks.
## Vulnerability
Gitea's "Allow edits from maintainers" PR option can be abused via reverse-fork PRs:
1. The web UI PR-create endpoint binds `allow_maintainer_edit=true` **without** verifying that the submitter has write access to the HEAD repository.
2. Gitea allows creating a PR where **BASE = attacker's fork** and **HEAD = upstream target**. The attacker is "maintainer" of the BASE (their own fork), so the flag is set against the upstream HEAD.
3. On `git push` over HTTP/SSH, Gitea relaxes the required
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://blog.gitea.com/release-of-1.26.2/https://github.com/go-gitea/gitea/pull/37479https://github.com/go-gitea/gitea/pull/37484https://github.com/go-gitea/gitea/releases/tag/v1.26.2https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4rhttps://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r
2026-07-03
Published