← All advisories

High severity7.5NVD Advisory· Published Jul 3, 2026· Updated Jul 7, 2026

CVE-2026-27660

CVE-2026-27660

Description

Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
code.gitea.io/giteaGo	< 1.25.5	1.25.5

Affected products

1

Go Gitea/Giteallm-fuzzy
Range: <1.25.5

Patches

Vulnerability mechanics

References

9

github.com/advisories/GHSA-x92v-f5gc-r34vghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-27660ghsaADVISORY
blog.gitea.com/release-of-1.25.5ghsaWEB
github.com/go-gitea/gitea/commit/1eced4a7c099459af42412bb32a83241650c0f8fghsaWEB
github.com/go-gitea/gitea/commit/e7fca90a780e4d35eb1fa67b1f377ebd54e74611ghsaWEB
github.com/go-gitea/gitea/pull/36659nvdWEB
github.com/go-gitea/gitea/pull/36715nvdWEB
github.com/go-gitea/gitea/releases/tag/v1.25.5nvdWEB
blog.gitea.com/release-of-1.25.5/nvd

News mentions

0

No linked articles in our index yet.