CVE-2026-26231: Gitea Auth Bypass Vulnerability

CVE-2026-26231 Overview

CVE-2026-26231 is a broken access control vulnerability in Gitea, an open-source self-hosted Git service. The flaw affects Gitea versions up to and including 1.26.1. The Allow edits from maintainers permission path authorizes commits to repositories that a user can read but should not be able to write. This authorization gap allows attackers with limited privileges to push commits to repositories beyond their permitted scope. The issue is classified under CWE-863: Incorrect Authorization. Gitea addressed the vulnerability in release 1.26.2.

Critical Impact
Authenticated users can commit code to repositories they should only be able to read, undermining source code integrity and enabling supply chain tampering.

Affected Products

Gitea versions up to and including 1.26.1
Self-hosted Gitea instances exposing pull request workflows
Gitea deployments with the Allow edits from maintainers feature enabled

Discovery Timeline

2026-07-03 - CVE-2026-26231 published to NVD
2026-07-07 - Last updated in NVD database
Patch Release - Gitea 1.26.2 released with fixes referenced in Pull Request #37479 and Pull Request #37484

Technical Details for CVE-2026-26231

Vulnerability Analysis

The vulnerability resides in the authorization logic that handles the Allow edits from maintainers option on pull requests. This Gitea feature lets pull request authors grant repository maintainers permission to push commits to the source branch of their fork. The intent is to allow trusted maintainers to make small fixes before merging.

Gitea incorrectly evaluates the permission check on the target repository rather than validating write access on the source repository. As a result, users who can only read a repository can be authorized to push commits when the Allow edits from maintainers flag is set. This breaks the principle of least privilege and violates the expected repository access model.

The consequences include unauthorized modification of protected branches, injection of malicious commits into pull request workflows, and potential compromise of downstream build pipelines that consume Gitea repositories.

Root Cause

The root cause is an authorization check that trusts the pull request context instead of re-validating write permissions against the target branch. The permission path skips a repository-level write check for users flagged as maintainers, even when their actual role does not grant write access. Details of the corrective changes appear in Gitea Pull Request #37479 and Pull Request #37484.

Attack Vector

An attacker requires an authenticated Gitea account with read access to the target repository. The attacker interacts with a pull request that has Allow edits from maintainers enabled and pushes commits through the exposed permission path. No user interaction from the victim is required beyond the pre-existing pull request setting. The attack is executed over the network against the Gitea HTTP or SSH interfaces. See the GitHub Security Advisory GHSA-mm7c-rhg6-qr4r for the full advisory.

Detection Methods for CVE-2026-26231

Indicators of Compromise

Commits authored by users who do not appear in the repository collaborator list or team membership
Unexpected git push events over HTTPS or SSH from accounts with read-only role assignments
Modifications to pull request source branches by non-owner accounts through the Gitea API endpoint /repos/{owner}/{repo}/pulls/{index}
Audit log entries showing branch updates that do not correlate with the pusher's stated repository permissions

Detection Strategies

Correlate Gitea action logs (repo.push, pull_request.push) against role assignment tables to flag pushes by users without write permission
Review pull requests where allow_maintainer_edit is enabled and inspect commit authors for anomalies
Compare git reflog history on the Gitea server against expected contributor lists for protected branches

Monitoring Recommendations

Forward Gitea webhook events and application logs to a centralized SIEM for authorization anomaly analysis
Alert on any push event where the pusher's cached repository permission is read but the operation succeeds
Track version banners returned by Gitea to identify instances still running 1.26.1 or earlier

How to Mitigate CVE-2026-26231

Immediate Actions Required

Upgrade all Gitea instances to version 1.26.2 or later using the guidance in the Gitea 1.26.2 release announcement
Audit open pull requests with Allow edits from maintainers enabled and review recent commits for unauthorized changes
Rotate any secrets, tokens, or signing keys stored in repositories that may have been exposed through unauthorized commits
Enforce branch protection rules that require signed commits and reviewed pull requests on production branches

Patch Information

Gitea released version 1.26.2 containing the authorization fixes. Download details are available at the Gitea Release v1.26.2 page. Administrators should apply the update to all self-hosted Gitea instances and container images. The patch reworks the maintainer-edit permission path to re-check write access against the source repository before authorizing commits.

Workarounds

Disable the Allow edits from maintainers option on pull requests until the upgrade is complete
Restrict repository visibility to trusted users where feasible to reduce the pool of accounts capable of triggering the flaw
Apply branch protection rules that require pull request approvals and status checks before merges
Monitor the Gitea audit log for push events from accounts that lack a documented write role

bash

# Verify Gitea version after upgrade
gitea --version

# Example: disable allow_maintainer_edit on an existing pull request via API
curl -X PATCH \
  -H "Authorization: token $GITEA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"allow_maintainer_edit": false}' \
  https://gitea.example.com/api/v1/repos/OWNER/REPO/pulls/INDEX