Go/code.gitea.io/gitea CVE-2026-27780: critical 9.8, EPSS 0.64%

Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea

Action: Upgrade code.gitea.io/gitea to 1.26.0 or later.

go get code.gitea.io/gitea@v1.26.0

Affected

Fixed versions

Sources

• osv: GO-2026-6346
• nvd: CVE-2026-27780
• https://github.com/advisories/GHSA-vhq7-fwwh-7hjf
• https://blog.gitea.com/release-of-1.26.0
• https://github.com/go-gitea/gitea/commit/c453d09c36fad094405314dba2f370434b200711
• https://github.com/go-gitea/gitea/pull/36963
• https://github.com/go-gitea/gitea/releases/tag/v1.26.0

CVE-2026-27780 · published 2026-09-10T14:48:42Z · modified 2026-09-10T15:15:12.307824043Z · JSON