CVE-2026-27660: Gitea Draft Release Access Control Bypass (CVSS 7.5)

Technical summary

CVE-2026-27660 is an improper access control vulnerability (CWE-284) affecting Gitea's draft release feature. The vulnerability allows unauthenticated or unauthorized users to bypass write-permission checks and access draft release metadata and attachments. The flaw exists in versions prior to 1.25.5 and stems from insufficient authorization validation when serving draft release resources. The CVSS 3.1 score of 7.5 (HIGH) reflects the network-adjacent attack vector, low complexity, absence of privilege requirements, and high confidentiality impact, though integrity and availability are not affected.

Business impact

Organizations using Gitea to host private or confidential repositories face unintended disclosure of draft release notes, internal documentation, and attached artifacts (binaries, keys, configurations, or other files). For software vendors and internal development teams, draft releases often contain unreleased features, security details, or pre-release builds intended only for authorized reviewers. Unauthorized access can lead to competitive intelligence leakage, early disclosure of security fixes, or unintended distribution of incomplete or sensitive materials. The risk is elevated in environments where draft releases serve as staging areas for internal coordination before public release.

Affected systems

All Gitea instances running versions before 1.25.5 are vulnerable. This includes self-hosted deployments across cloud providers, on-premises servers, and containerized environments. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the latest update, indicating active in-the-wild exploitation has not been documented at publication time, though the ease of exploitation should not be assumed indicative of low risk.

Exploitability

The vulnerability is straightforward to exploit. An attacker with network access can request draft release endpoints directly without authentication or special tooling. The attack surface includes any Gitea instance exposed to untrusted networks. No authentication is required, and no user interaction is necessary—a simple HTTP request to a draft release URL is sufficient to retrieve protected data. The low complexity and absence of privilege requirements make this a low-friction attack.

Remediation

Upgrade Gitea to version 1.25.5 or later. This version implements proper authorization checks to ensure that draft release access is restricted to users with appropriate write permissions. Verify the upgrade against the official Gitea release notes and advisories. Until patching is possible, consider restricting network access to your Gitea instance to trusted networks only, and audit draft release access logs for suspicious activity.

Patch guidance

Apply the Gitea 1.25.5 update as soon as feasible, prioritizing instances that host sensitive internal projects or contain draft releases with confidential data. The patch is a security fix and should be treated as such in your change management process. Test the upgrade in a staging environment first to ensure compatibility with any custom configurations or extensions. Most organizations should be able to deploy within 1–2 weeks of release; expedite if draft releases contain unreleased security fixes or other time-sensitive information.

Detection guidance

Monitor access logs for requests to draft release endpoints (typically `/api/v1/repos/{owner}/{repo}/releases/` with draft flags or specific draft IDs). Alert on successful HTTP 200 responses to draft release URLs from unauthenticated sources or users without write permissions. Review Gitea's audit logs for unexpected access to draft release metadata or file downloads. If available, enable verbose logging on release-related API calls and correlate with user identity and IP source.

Why prioritize this

While not yet exploited in the wild according to CISA, the vulnerability is HIGH-severity due to direct confidentiality impact and ease of exploitation. Organizations should prioritize patching based on the sensitivity of draft release content: expedite for repos containing unreleased security advisories, pre-release software, or internal documentation; apply within standard SLA for lower-risk instances. The absence of KEV listing should not delay remediation—it reflects lack of confirmed active exploitation, not absence of risk.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects an unauthenticated, network-accessible vulnerability with low attack complexity and high confidentiality impact. The absence of integrity or availability impact (attackers cannot modify or delete data) prevents a critical rating, but the ease of exploitation and breadth of potential exposure justify a HIGH severity. Organizations handling regulated data or intellectual property should treat this as critical-priority regardless of the numerical score.

Frequently asked questions