CVE-2026-27761: Gitea RSS/Atom Feed Authorization Bypass (CVSS 4.3)

Technical summary

CVE-2026-27761 is an authorization bypass vulnerability in Gitea's feed infrastructure. The vulnerability stems from insufficient scope validation on repository RSS and Atom feed endpoints (CWE-863: Improper Authorization). While Gitea's general API enforces fine-grained token scopes, the feed endpoints bypass this control layer, allowing an authenticated attacker holding a token without repository-level permissions to enumerate and view private repository commits through feed consumption. The vulnerability requires an authenticated session or valid (albeit insufficiently scoped) API token, limiting exposure to users with at least basic platform access.

Business impact

Organizations self-hosting Gitea for private code repositories face a direct risk of unintended information disclosure. An internal user or contractor with limited API permissions could access commit histories, code changes, and repository metadata they should not be able to see. This is particularly concerning for teams managing multiple security-sensitive repositories or using token-based CI/CD integrations, where overly permissive tokens are sometimes distributed. The breach of scope enforcement erodes trust in Gitea's access control model and may violate internal compliance policies around least-privilege access.

Affected systems

All Gitea instances running version 1.26.2 or earlier are affected. Gitea 1.26.3 and later versions contain fixes for this issue. Self-hosted Gitea deployments are the primary attack surface; this does not affect Gitea.com or other managed hosting services that maintain independent patch schedules. The vulnerability is most relevant to organizations running Gitea in air-gapped or internal network environments where multiple users or service accounts hold different API tokens.

Exploitability

Exploitation requires an authenticated attacker with a valid Gitea account or API token, even if that token lacks the intended repository scope. No special privileges, user interaction, or network positioning beyond standard internet access is required. The attack is straightforward: an attacker simply requests the RSS or Atom feed URL for a private repository using an insufficiently scoped token, and the endpoint returns commit data. This low barrier to exploitation is mitigated by the requirement for initial authentication; opportunistic mass scanning from the open internet is not feasible without valid credentials.

Remediation

Upgrade Gitea to version 1.26.3 or later, which implements proper scope validation on feed endpoints. Verify the upgrade against official Gitea release notes and checksums. For organizations unable to patch immediately, implement network controls restricting API token usage to specific repositories and monitor feed endpoint access logs for anomalous patterns. Consider rotating tokens with broad permissions and issuing narrowly scoped tokens for specific CI/CD jobs or integrations.

Patch guidance

Administrators should consult the official Gitea release notes for version 1.26.3 or later to confirm the fix and any additional changes. Patch rollout can typically be performed with minimal service interruption on small to medium deployments; however, test in a staging environment first, particularly if custom feed integrations or monitoring scripts consume Gitea feeds. After patching, review active API tokens and regenerate any that were created with overly broad scopes, especially those used in third-party integrations or automation.

Detection guidance

Monitor Gitea API access logs for requests to feed endpoints (typically paths like `/repos/{owner}/{repo}/rss.xml` or `/repos/{owner}/{repo}/atom.xml`) originating from tokens or users that lack documented permission to access those repositories. Correlate feed endpoint requests with the scopes recorded in token audit logs. Organizations using Gitea's built-in audit features should review API token creation and usage patterns; tokens with read-only scopes being used to access feed endpoints on repositories outside their intended scope are a red flag. Additionally, monitor for unusual feed consumption patterns or repeated 200 responses to feed requests from the same token across multiple repositories.

Why prioritize this

Although this vulnerability carries a MEDIUM CVSS score, it is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and does not pose widespread risk to publicly exposed instances. However, organizations running Gitea should still prioritize patching because the vulnerability undermines the integrity of token-based access controls—a foundational security model for API-first platforms. The fix is available and straightforward to deploy. Prioritize patching if your organization issues multiple tokens with different scopes or runs Gitea in a multi-tenant or multi-team environment where separation of repository access is a security requirement.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects a low attack complexity, requirement for prior authentication, and limited scope of impact (confidentiality only). The attack vector is network-accessible and requires no user interaction. The score appropriately reflects that this is not a critical vulnerability enabling remote code execution or wide-scale compromise, but it is a meaningful information disclosure flaw in access controls that merits timely remediation in organizations with strong separation of duties or high-sensitivity repositories.

Frequently asked questions