high7.5
CVE-2026-27660
Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.
Impact
Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | code.gitea.io/gitea | < 1.25.5 | 1.25.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-x92v-f5gc-r34v
- https://nvd.nist.gov/vuln/detail/CVE-2026-27660
- https://github.com/go-gitea/gitea/pull/36659
- https://github.com/go-gitea/gitea/pull/36715
- https://blog.gitea.com/release-of-1.25.5
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5
- https://github.com/go-gitea/gitea/commit/1eced4a7c099459af42412bb32a83241650c0f8f
- https://github.com/go-gitea/gitea/commit/e7fca90a780e4d35eb1fa67b1f377ebd54e74611
- https://blog.gitea.com/release-of-1.25.5/