CVE-2026-27783
published 2026-07-03CVE-2026-27783: Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.34%
26.8th percentile
Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.26.2 | 1.26.2 |
| gitea | gitea_open_source_git_server | <= 1.26.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Gitea up to 1.26.1 API Endpoint authorization (GHSA-3fwp-p5rj-2pxf)
vuldb·2026-07-04·CVSS 4.3
CVE-2026-27783 [MEDIUM] Gitea up to 1.26.1 API Endpoint authorization (GHSA-3fwp-p5rj-2pxf)
A vulnerability was found in Gitea up to 1.26.1 and classified as problematic. This affects an unknown part of the component API Endpoint. Such manipulation leads to missing authorization.
This vulnerability is listed as CVE-2026-27783. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
Gitea: Missing repository-unit authorization on issue-template API endpoints
ghsa·2026-06-16
CVE-2026-27783 [MEDIUM] CWE-862 Gitea: Missing repository-unit authorization on issue-template API endpoints
Gitea: Missing repository-unit authorization on issue-template API endpoints
## Summary
Three Gitea API endpoints — `GET /repos/{owner}/{repo}/issue_templates`,
`GET /repos/{owner}/{repo}/issue_config` and `GET /repos/{owner}/{repo}/issue_config/validate`
— read files from the repository's **Code** default branch (`.gitea/ISSUE_TEMPLATE/*`
and `issue_config.yaml`) and return their contents, but are registered **without**
the `reqRepoReader(unit.TypeCode)` authorization middleware that every sibling
Code-tree endpoint in the same route group carries.
A user who has access to a private repository through *any single repository unit*
(for example an organization team granted only the **Issues** unit, with no Code
access) can therefore read the issue-template and issue-config files of that
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://blog.gitea.com/release-of-1.26.2/https://github.com/go-gitea/gitea/pull/37769https://github.com/go-gitea/gitea/pull/37781https://github.com/go-gitea/gitea/releases/tag/v1.26.2https://github.com/go-gitea/gitea/security/advisories/GHSA-3fwp-p5rj-2pxfhttps://github.com/go-gitea/gitea/security/advisories/GHSA-3fwp-p5rj-2pxf
2026-07-03
Published