CVE-2026-27761: Gitea Auth Bypass Vulnerability

CVE-2026-27761 Overview

CVE-2026-27761 is an authorization bypass vulnerability in Gitea versions up to and including 1.26.2. The flaw allows repository RSS and Atom feed endpoints to skip API access token scope enforcement. Attackers holding a valid token without the required repository scope can read commit data from private repositories through these feed endpoints. The issue is tracked under [CWE-863] (Incorrect Authorization) and was addressed in Gitea 1.26.3.

Critical Impact
Authenticated users with under-scoped API tokens can retrieve private repository commit metadata via RSS and Atom feeds, breaking Gitea's token scope isolation model.

Affected Products

Gitea versions up to and including 1.26.2
Gitea repository RSS feed endpoint
Gitea repository Atom feed endpoint

Discovery Timeline

2026-07-03 - CVE-2026-27761 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-27761

Vulnerability Analysis

Gitea enforces scoped access tokens to restrict what an authenticated client can read or write through the API. The RSS and Atom feed handlers for repository endpoints do not apply the same scope-check logic used by other repository routes. A token issued for an unrelated scope, such as user profile or notification access, can still request the feed URL for a private repository. The server responds with commit information that should require the repository read scope.

The consequence is information disclosure of commit metadata, including commit messages, author identities, and timestamps from private repositories. The vulnerability does not affect integrity or availability, and exploitation requires an authenticated account with a valid API token.

Root Cause

The root cause is a missing authorization check in the feed rendering path. The feed handlers route through logic that validates repository visibility but skips the token scope validation middleware applied to standard API endpoints. This inconsistency between the feed path and the general API path produces the bypass described in GHSA-3pww-vcvm-3gmj.

Attack Vector

An attacker authenticates to Gitea with a low-privilege API token. The attacker then requests the RSS or Atom feed URL for a targeted private repository, for example /{owner}/{repo}.rss or /{owner}/{repo}.atom. Because the feed handler does not verify that the token holds the repository scope, the server returns feed content containing commit data from the private repository. See the Gitea Pull Request Update for the fix implementation.

No verified public exploit code is available. The vulnerability is described in prose only based on the vendor advisory.

Detection Methods for CVE-2026-27761

Indicators of Compromise

Unexpected HTTP GET requests to .rss or .atom paths under private repository routes
Access log entries showing feed requests authenticated by API tokens that lack repository read scope
Repeated feed endpoint requests from a single token across multiple private repositories

Detection Strategies

Correlate Gitea access logs against issued token scopes to find feed requests that should have been denied
Alert on any successful 200 OK response for .rss or .atom requests where the requesting token scope does not include repository read
Baseline normal feed consumption per token and flag deviations that touch previously unaccessed private repositories

Monitoring Recommendations

Forward Gitea application and reverse proxy logs to a centralized log platform for token-to-endpoint correlation
Track token issuance events and map each token identifier to its granted scopes for enrichment during detection
Review audit logs for private repositories with recently accessed feeds and validate the caller identity

How to Mitigate CVE-2026-27761

Immediate Actions Required

Upgrade Gitea to version 1.26.3 or later as documented in the Gitea Release Announcement
Rotate API tokens that may have been used to access unauthorized feed content
Audit private repository access logs for feed endpoint requests since the affected versions were deployed

Patch Information

The fix is included in the Gitea Version 1.26.3 Release. The patch adds token scope enforcement to the RSS and Atom feed handlers so they reject requests from tokens lacking the required repository scope. Administrators should upgrade production instances immediately and verify the running version after deployment.

Workarounds

Restrict access to the Gitea instance at the network layer to trusted users while the upgrade is pending
Revoke API tokens that are not strictly required, reducing the population of tokens that could exploit the bypass
Configure a reverse proxy rule to block unauthenticated and low-privilege access to .rss and .atom feed paths until patching is complete

bash

# Configuration example: nginx rule to block feed paths pending upgrade
location ~* \.(rss|atom)$ {
    return 403;
}