CVE-2026-27775: Gitea 1.25.5 Permission Cache Privilege Escalation

Technical summary

CVE-2026-27775 stems from improper permission-cache management in Gitea's pre-receive hook processing. The vulnerability leverages CWE-863 (Incorrect Authorization) by caching branch-specific write-permission verdicts at the session level rather than evaluating permissions per-ref. When a push targets multiple refs or when authorization checks are performed once and reused, a user granted write access to a single branch can bypass controls and modify unintended refs. The flaw is specific to Gitea 1.25.5 and affects the permission model during git push operations.

Business impact

This vulnerability enables insider threats and compromised low-privilege accounts to escalate to repository-wide write access without additional credentials or configuration changes. An attacker could inject malicious commits into production branches, delete critical release tags, or alter deployment automation. For organizations using Gitea as a central code repository, this poses a significant integrity and supply-chain risk, particularly if branch protection rules are relied upon to enforce code review or separation of duties.

Affected systems

Gitea version 1.25.5 is vulnerable. Organizations running this specific version should inventory affected instances immediately. Gitea deployments in self-hosted or private cloud environments are in scope. The vulnerability does not appear in the vendor advisory data to affect other versions, but users should verify patch availability and upgrade paths with the Gitea project.

Exploitability

Exploitation requires valid Gitea credentials (PR:L in the CVSS vector), but no complex attack setup is needed—a standard git push operation can trigger the flaw. No user interaction is required beyond the attacker's own push. The network-accessible nature of git repositories (AV:N) and lack of complex prerequisites (AC:L) make this straightforward to exploit once an attacker has any branch-write permission. The high impact (C:H, I:H, A:H covering confidentiality, integrity, and availability) reflects the ability to read, modify, or delete repository content at scale.

Remediation

Upgrade Gitea to a patched version that fixes permission-cache handling in pre-receive hooks. Verify the exact patched version against the Gitea security advisory or release notes. As an interim control, restrict branch-write permissions to trusted users only and enforce repository-wide access policies. Consider disabling or auditing pre-receive hooks pending patch deployment.

Patch guidance

Check the Gitea project's official releases and security advisories for a version beyond 1.25.5 that addresses CVE-2026-27775. Apply the patch promptly to all affected Gitea instances, prioritizing production repositories. Test the upgrade in a staging environment first, particularly if you use custom pre-receive hooks or branch protection rules, to ensure no regression in authorization behavior.

Detection guidance

Monitor git push operations targeting multiple refs or refs outside the user's expected write scope. Log and alert on authorization cache hits or permission reuse events in Gitea's audit trail. Review pre-receive hook execution logs for instances where a single authorization decision was applied across multiple branches. Inspect recent git history for unexpected commits or deletions by users with limited historical privileges. Network-based detection is difficult; focus on repository-side logs and access patterns.

Why prioritize this

The combination of high CVSS score (8.8), broad impact (full repository write access), low barrier to exploitation (any authenticated user with branch-write permission), and the clear path to insider escalation make this a critical priority. Organizations should treat patching or mitigating this vulnerability as urgent to prevent code tampering and supply-chain compromise.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH) reflects network accessibility, low attack complexity, low privilege requirement, high impact on confidentiality/integrity/availability, and no user interaction needed. The vulnerability enables an authenticated attacker to escalate from limited branch access to full repository control, satisfying all high-impact criteria. The absence of scope change (S:U) slightly constrains the theoretical maximum score but does not diminish the real-world threat.

Frequently asked questions