Gitea draft releases and attachments are exposed without write permission
Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-27660US | — | — | ||
Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission. | ||||
02
references
External citations — patches, advisories, analysis.
- https://blog.gitea.com/release-of-1.25.5WEB
- https://github.com/go-gitea/giteaPACKAGE
- https://github.com/go-gitea/gitea/commit/1eced4a7c099459af42412bb32a83241650c0f8fWEB
- https://github.com/go-gitea/gitea/commit/e7fca90a780e4d35eb1fa67b1f377ebd54e74611WEB
- https://github.com/go-gitea/gitea/pull/36659WEB
- https://github.com/go-gitea/gitea/pull/36715WEB
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-27660ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan