https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 11:35:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-333362 EUVD-2026-333362 https://cve.radiocsirt.org/vuln/euvd-2026-333362 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27775 <p>Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.</p> <p>Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27775 https://cve.radiocsirt.org/vuln/ghsa-649p-mmhf-85c7 <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Vulnerability Header</p> <p>| Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High | | Bug Category | Authorization Bypass | | Location | `routers/private/hook_pre_receive.go:55-64`, `CanWriteCode()` | | Affected Versions | 1.25.5 |</p> <p>## Executive Summary</p> <p>The pre-receive hook in Gitea evaluates the `CanMaintainerWriteToBranch` permission only once per `git push` session and caches the result for all subsequent refs in the same batch. An attacker who has a legitimate per-branch write grant (e.g., via an open pull request with &#34;Allow edits from maintainers&#34; enabled) can batch-push that branch together with any other ref. The cached `true` from the first ref is reused for all following refs, allowing the attacker to overwrite protected branches (including `main`), create arbitrary new branches, and push tags. This effectively escalates a single-branch maintainer-edit grant into full repository write access.</p> <p>## Root Cause Anal…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Vulnerability Header</p> <p>| Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High | | Bug Category | Authorization Bypass | | Location | `routers/private/hook_pre_receive.go:55-64`, `CanWriteCode()` | | Affected Versions | 1.25.5 |</p> <p>## Executive Summary</p> <p>The pre-receive hook in Gitea evaluates the `CanMaintainerWriteToBranch` permission only once per `git push` session and caches the result for all subsequent refs in the same batch. An attacker who has a legitimate per-branch write grant (e.g., via an open pull request with &#34;Allow edits from maintainers&#34; enabled) can batch-push that branch together with any other ref. The cached `true` from the first ref is reused for all following refs, allowing the attacker to overwrite protected branches (including `main`), create arbitrary new branches, and push tags. This effectively escalates a single-branch maintainer-edit grant into full repository write access.</p> <p>## Root Cause Anal…</p> https://cve.radiocsirt.org/vuln/ghsa-649p-mmhf-85c7 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2027 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um erweiterte Berechtigungen zu erlangen, sich als Benutzer auszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um erweiterte Berechtigungen zu erlangen, sich als Benutzer auszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2027