Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the pre-receive process. An attacker can gain unauthorized write access to the entire repository by exploiting cached branch-specific write-permission results across multiple refs within a single session...

CVE-2026-27775

Gitea versions prior to 1.26.3 (specifically 1.25.5 ) are vulnerable to an Authorization Bypass in the pre-receive hook. The system evaluates the CanMaintainerWriteToBranch permission only once per git push session and caches the result for all subsequent refs in the same batch. An attacker with ...