VULNERABILITY INTELLIGENCE
CVE-2026-27761
CVSS score4.3 MEDIUM
EPSS probability0.45%
CISA KEVNot currently listed
Published2026-07-03
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.
Weakness classification
- 88ee5874-cf24-4952-aea0-31affedb7ff2: CWE-863