CVE-2026-27761

—

CVSS 3.1

4.3 medium

EPSS

<1%p30

Published

Jul 3, 2026 (Jul 3, 2026)

Modified

Jul 7, 2026

Description

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.