CVE-2026-27783: Gitea Auth Bypass Vulnerability

CVE-2026-27783 Overview

CVE-2026-27783 is a missing authorization vulnerability [CWE-862] in Gitea, the self-hosted Git service. Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints. Authenticated users can query issue-template data from repositories where the Issues unit has been disabled or restricted. The flaw affects confidentiality only and requires low privileges over the network. Gitea addressed the issue in release 1.26.2 through pull requests #37769 and #37781.

Critical Impact
Authenticated attackers can read repository issue-template information through API endpoints that skip repository-unit access checks, exposing data intended to be restricted.

Affected Products

Gitea versions up to and including 1.26.1
Self-hosted Gitea instances exposing the REST API
Gitea deployments that rely on repository-unit toggles to restrict Issues access

Discovery Timeline

2026-07-03 - CVE-2026-27783 published to the National Vulnerability Database
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-27783

Vulnerability Analysis

Gitea exposes REST API endpoints that return issue-template metadata for a repository. In versions up to 1.26.1, these endpoints do not check whether the caller has authorization for the repository's Issues unit. Repository administrators can disable or restrict units such as Issues, Wiki, or Pull Requests on a per-repository basis. The issue-template endpoints bypassed this check and served template data regardless of unit configuration. The vulnerability is classified as Missing Authorization [CWE-862]. Impact is limited to information disclosure, with no integrity or availability effects reported. EPSS data records a score of 0.283% with a percentile of 20.189, indicating low near-term exploitation probability.

Root Cause

The root cause is missing repository-unit authorization on the issue-template API handlers. Gitea enforces unit-level access control elsewhere in the API, but the template endpoints omit that verification. Any authenticated user with baseline read access to the repository can invoke the endpoints. The upstream fix in pull requests #37769 and #37781 adds the unit authorization check before returning template data.

Attack Vector

An authenticated user sends HTTP requests to Gitea REST API endpoints that return issue templates for a target repository. Because the endpoints do not enforce Issues-unit authorization, they respond with template content even when the Issues unit is disabled. The attack requires a valid Gitea account and network reachability to the server. Refer to the GitHub Security Advisory GHSA-3fwp-p5rj-2pxf for maintainer details.

// No verified proof-of-concept code is published for this issue.
// See the upstream advisory and pull requests for technical details:
// - https://github.com/go-gitea/gitea/pull/37769
// - https://github.com/go-gitea/gitea/pull/37781

Detection Methods for CVE-2026-27783

Indicators of Compromise

Authenticated API requests to Gitea issue-template endpoints against repositories where the Issues unit is disabled.
Unusual volumes of GET requests enumerating repositories through the issue-template API from a single account or token.
Successful 200 OK responses to issue-template API calls from users who lack Issues-unit access in application logs.

Detection Strategies

Compare Gitea access logs against repository unit configuration to flag issue-template responses that should have been blocked.
Alert on API tokens issuing repeated issue-template requests across many repositories in a short window.
Correlate authentication events with API request patterns to identify accounts probing multiple repositories for template data.

Monitoring Recommendations

Ingest Gitea application and reverse-proxy logs into a centralized logging platform for query and retention.
Monitor for spikes in /api/v1/repos/*/issue_templates and related endpoints after upgrading detection rules.
Track the installed Gitea version across all self-hosted instances and alert when any node reports <= 1.26.1.

How to Mitigate CVE-2026-27783

Immediate Actions Required

Upgrade all Gitea instances to version 1.26.2 or later using the GitHub Release v1.26.2 artifacts.
Rotate any API tokens or credentials suspected of being used to enumerate issue-template endpoints.
Review repositories that rely on the Issues unit being disabled and confirm no sensitive data was placed in issue templates.

Patch Information

Gitea released version 1.26.2 containing the authorization fix. Details are available in the Gitea Blog Release Announcement, GitHub Pull Request #37769, and GitHub Pull Request #37781. Administrators should apply the update through their standard package or container workflow and restart the Gitea service.

Workarounds

Restrict Gitea API access to trusted networks using a reverse proxy or firewall rules until the patch is applied.
Reduce the number of authenticated users on affected instances and disable self-registration where feasible.
Remove sensitive content from issue templates on repositories where the Issues unit is intentionally restricted.

bash

# Verify installed Gitea version and upgrade path
gitea --version
# Example upgrade for container deployments
docker pull gitea/gitea:1.26.2
docker stop gitea && docker rm gitea
# Recreate the container using your existing volume and configuration