CVE-2026-27775: Gitea Privilege Escalation Vulnerability

CVE-2026-27775 Overview

CVE-2026-27775 is an authorization flaw in Gitea 1.25.5 that allows a user with maintainer-edit rights on a single branch to gain full write access to a repository. The Gitea pre-receive hook caches a branch-specific write-permission result and reuses it across other refs pushed in the same session. An attacker who legitimately holds a per-branch maintainer-edit grant can push updates to protected branches or refs they should not be able to modify. The vulnerability is tracked as an incorrect authorization issue under [CWE-863].

Critical Impact
A low-privileged contributor with a single-branch maintainer-edit grant can escalate to full repository write access, including protected branches, by piggybacking additional refs into one push session.

Affected Products

Gitea 1.25.5
Gitea versions prior to 1.26.3
Self-hosted Gitea deployments using branch protection with maintainer-edit grants

Discovery Timeline

2026-07-03 - CVE-2026-27775 published to the National Vulnerability Database
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-27775

Vulnerability Analysis

Gitea enforces branch-level write permissions inside the pre-receive Git hook. When a client pushes multiple refs in one operation, the hook processes each ref sequentially against the repository's protected-branch configuration. In Gitea 1.25.5 the hook caches the outcome of a write-permission check keyed in a way that ignores the target ref. The first affirmative result is reused for every subsequent ref evaluated in that hook session.

A user who holds a maintainer-edit grant on one specific branch legitimately passes the first check. The cached positive result then applies to any additional refs included in the same push, including protected branches such as main or release/*. The check therefore behaves as an all-or-nothing decision rather than a per-ref decision. This defeats branch protection and elevates a scoped contributor to a repository-wide writer.

Root Cause

The root cause is a scope error in a memoization layer used by the pre-receive permission code path. The cache treats a positive branch-specific decision as a session-wide grant instead of a per-ref grant. The fix landed in GitHub Pull Request #38151 and is documented in the GitHub Security Advisory GHSA-649p-mmhf-85c7.

Attack Vector

An authenticated attacker with maintainer-edit rights on any single branch crafts a single git push that updates the branch they legitimately control and one or more protected refs in the same command. The pre-receive hook approves the first branch, caches the write decision, and applies it to the remaining refs. The attacker can therefore overwrite protected branches, push malicious commits into release branches, or rewrite tags. Exploitation requires network access to the Gitea instance and low privileges, with no user interaction.

Detection Methods for CVE-2026-27775

Indicators of Compromise

Push events that update multiple refs in one operation where one ref is a branch the user has maintainer-edit rights on and another is a protected branch.
Commits on protected branches signed or authored by accounts that do not hold repository-wide write access.
Unexpected force-updates or fast-forward updates to main, master, or release/* from contributor accounts.
Pre-receive hook logs that show successive permission checks with identical cached outcomes across differing refs.

Detection Strategies

Audit Gitea action logs for repo.push events targeting more than one ref and correlate the ref list against the actor's granted branch scope.
Enable Git server-side receive logging and alert when a single push updates both a maintainer-edit branch and a protected branch.
Compare commit authors on protected branches against the repository's collaborator role list to surface unauthorized writes.

Monitoring Recommendations

Forward Gitea application logs and Git hook logs to a centralized SIEM for correlation across push, permission, and branch-protection events.
Alert on any change to protected refs performed by users whose role is not repository admin or full writer.
Track the installed Gitea version and flag any instance still running 1.25.5 or earlier versions vulnerable to CVE-2026-27775.

How to Mitigate CVE-2026-27775

Immediate Actions Required

Upgrade Gitea to version 1.26.3 or 1.26.4 as announced in the Gitea Release Announcement.
Review recent commits on protected branches for unauthorized changes originating from users with only per-branch maintainer-edit grants.
Rotate deploy keys, tokens, and CI credentials that may have been exposed by unauthorized pushes to release branches.

Patch Information

The fix is included in the Gitea Version 1.26.3 Release and is delivered by GitHub Pull Request #38151. The patch changes the pre-receive permission cache so decisions are scoped per ref rather than being reused across the hook session. Administrators running self-hosted Gitea should schedule the upgrade promptly and follow the standard Gitea upgrade procedure.

Workarounds

Revoke per-branch maintainer-edit grants until the instance is upgraded, forcing contributors to open pull requests instead.
Restrict push access on protected branches to repository administrators only.
Require signed commits and enforce server-side verification of authorship on protected branches.
Disable the ability to push multiple refs in a single operation through custom pre-receive tooling until patched.

bash

# Verify the installed Gitea version and upgrade path
gitea --version
# Expected output after remediation: Gitea version 1.26.3 or later