https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:45:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-333747 EUVD-2026-333747 https://cve.radiocsirt.org/vuln/euvd-2026-333747 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26231 <p>Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.</p> <p>Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-26231 https://cve.radiocsirt.org/vuln/ghsa-mm7c-rhg6-qr4r <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>Any authenticated low-privilege user with read access to a repository can push arbitrary commits directly to that repository, bypassing all write-access checks.</p> <p>## Vulnerability</p> <p>Gitea&#39;s &#34;Allow edits from maintainers&#34; PR option can be abused via reverse-fork PRs:</p> <p>1. The web UI PR-create endpoint binds `allow_maintainer_edit=true` **without** verifying that the submitter has write access to the HEAD repository. 2. Gitea allows creating a PR where **BASE = attacker&#39;s fork** and **HEAD = upstream target**. The attacker is &#34;maintainer&#34; of the BASE (their own fork), so the flag is set against the upstream HEAD. 3. On `git push` over HTTP/SSH, Gitea relaxes the required access mode to `Read` when `SupportProcReceive` is enabled ([`routers/web/repo/githttp.go`](https://github.com/go-gitea/gitea/blob/v1.25.5/routers/web/repo/githttp.go#L189), [`routers/private/serv.go`](https://github.com/go-gitea/gitea/blob/v1.25.5/routers/private/serv.go#L337)) and defers enforcement to the pre-receive hook. 4. The pre-receive hook calls [`CanMaintainerWriteToBranch`](https://github.com/go-gitea/gitea/blob/v1.25.5/models/issues/pull_list.go#L72) (`models/issues/pull_list.go`), which finds the malicious PR, sees `AllowMaintainerEdit=true`, and checks whether the pusher has write access to the **BASE** repo. Since BASE is the attacker&#39;s own fork, the check passes and the push is authorized against the upstream.</p> <p>## Exploitation</p> <p>1. Attacker forks the target repository. 2. Attacker visi…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>Any authenticated low-privilege user with read access to a repository can push arbitrary commits directly to that repository, bypassing all write-access checks.</p> <p>## Vulnerability</p> <p>Gitea&#39;s &#34;Allow edits from maintainers&#34; PR option can be abused via reverse-fork PRs:</p> <p>1. The web UI PR-create endpoint binds `allow_maintainer_edit=true` **without** verifying that the submitter has write access to the HEAD repository. 2. Gitea allows creating a PR where **BASE = attacker&#39;s fork** and **HEAD = upstream target**. The attacker is &#34;maintainer&#34; of the BASE (their own fork), so the flag is set against the upstream HEAD. 3. On `git push` over HTTP/SSH, Gitea relaxes the required access mode to `Read` when `SupportProcReceive` is enabled ([`routers/web/repo/githttp.go`](https://github.com/go-gitea/gitea/blob/v1.25.5/routers/web/repo/githttp.go#L189), [`routers/private/serv.go`](https://github.com/go-gitea/gitea/blob/v1.25.5/routers/private/serv.go#L337)) and defers enforcement to the pre-receive hook. 4. The pre-receive hook calls [`CanMaintainerWriteToBranch`](https://github.com/go-gitea/gitea/blob/v1.25.5/models/issues/pull_list.go#L72) (`models/issues/pull_list.go`), which finds the malicious PR, sees `AllowMaintainerEdit=true`, and checks whether the pusher has write access to the **BASE** repo. Since BASE is the attacker&#39;s own fork, the check passes and the push is authorized against the upstream.</p> <p>## Exploitation</p> <p>1. Attacker forks the target repository. 2. Attacker visi…</p> https://cve.radiocsirt.org/vuln/ghsa-mm7c-rhg6-qr4r https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1637 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um möglicherweise erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren und offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um möglicherweise erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren und offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1637