CVE-2026-27660 Gitea CVE debrief

Who should care

Users of Gitea versions before 1.25.5 should be aware of this vulnerability and take necessary actions to upgrade to a patched version. This includes administrators and security teams responsible for managing Gitea deployments. Additionally, developers who use Gitea for their projects should also be aware of this vulnerability and ensure that their projects are not exposed.

Technical summary

The vulnerability exists in Gitea versions before 1.25.5, where draft release data or attachments can be accessed without the required write permission. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. This vulnerability is classified under CWE-284. The vulnerability allows an attacker to access sensitive information without the required write permission, which can lead to a high severity impact.

Defensive priority

High

Recommended defensive actions

• Upgrade Gitea to version 1.25.5 or later
• Review and adjust permissions for draft releases and attachments
• Monitor for any suspicious activity related to draft releases and attachments
• Verify the integrity of draft releases and attachments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-03T21:16:58.830Z and was last modified on 2026-07-07T18:16:37.750Z. The NVD entry is currently Deferred. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The CVE record provides a brief description of the vulnerability, but additional details may be needed to fully understand the issue.

Official resources