Go/code.gitea.io/gitea CVE-2026-26231: unknown, EPSS 0.35%

Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo in code.gitea.io/gitea

Action: Upgrade code.gitea.io/gitea to 1.26.2 or later.

go get code.gitea.io/gitea@v1.26.2

Affected

Fixed versions

Sources

• osv: GO-2026-5510
• https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r

CVE-2026-26231 · published 2026-06-25T22:34:31Z · modified 2026-06-25T23:01:15.779489854Z · JSON