CVE-2026-27783: Gitea Issue-Template API Authorization Bypass (CVSS 4.3)

Technical summary

CVE-2026-27783 is an authorization bypass affecting Gitea up to version 1.26.1. The vulnerability stems from insufficient enforcement of repository-unit authorization controls on issue-template API endpoints (CWE-862: Missing Authorization). When a user makes an API call to retrieve or list issue templates, the endpoint fails to validate that the caller has the required repository access level before returning template data. The CVSS 3.1 score of 4.3 (MEDIUM) reflects low attack complexity, network accessibility, and limited confidentiality impact with no integrity or availability implications.

Business impact

Organizations using Gitea to host internal repositories may inadvertently expose issue-template configurations to users who lack explicit repository access. Issue templates often contain project workflows, naming conventions, and other metadata that could be leveraged for social engineering or process exploitation. The impact is primarily informational; however, in environments where template content is sensitive or contains embedded credentials or URLs, the disclosure could facilitate targeted attacks. Self-hosted instances are at risk regardless of Gitea instance size or role.

Affected systems

All Gitea installations running version 1.26.1 or earlier are vulnerable. The vulnerability affects the API layer specifically; web UI behavior may differ. Any Gitea instance exposed to authenticated users—whether internal team members or external collaborators—could be exploited. Verify your current version using 'gitea --version' or the web UI admin panel.

Exploitability

Exploitation requires valid authentication credentials; an unauthenticated attacker cannot exploit this flaw. An authenticated user can call the issue-template API endpoints directly (e.g., via curl, SDK, or web client) without special tooling. No user interaction is required. The low attack complexity and lack of privilege escalation requirements make this straightforward to exploit for anyone with repository login credentials, though the impact is constrained to information disclosure.

Remediation

Upgrade Gitea to a patched version released after July 6, 2026. Verify against the official Gitea security advisory and release notes for the specific version that resolves CWE-862 authorization enforcement. Organizations unable to patch immediately should implement network-level access controls to restrict API endpoint exposure or review access logs for unauthorized issue-template API calls.

Patch guidance

1. Check your current Gitea version in the admin panel or via CLI. 2. Review the official Gitea release notes and security advisory for the first patched version after 1.26.1. 3. Back up your Gitea database and configuration before upgrading. 4. Test the upgrade in a staging environment if possible. 5. Deploy the patched version and restart the Gitea service. 6. Audit recent API logs for unauthorized issue-template access post-upgrade.

Detection guidance

Search your Gitea API access logs for requests to endpoints matching '/api/v1/repos/*/issues/templates' or similar patterns from users who lack documented repository access. Monitor for unusual frequency of template retrieval API calls from service accounts or external integrations. If you have a WAF or API gateway in front of Gitea, log all requests to issue-template endpoints and correlate with repository access control lists.

Why prioritize this

While the CVSS score is MEDIUM (4.3), prioritize patching because the vulnerability is easy to exploit with valid credentials and has already been published. Organizations with many collaborators or external users should prioritize higher. However, the absence of KEV status and lack of evidence of in-the-wild exploitation mean this is not an emergency—standard patch management timelines are acceptable unless your Gitea instance hosts highly sensitive project metadata.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) Network-accessible API endpoint (AV:N), (2) Low attack complexity requiring only valid auth (AC:L), (3) Requires login; no privilege escalation (PR:L), (4) No user interaction needed (UI:N), (5) Confidentiality impact limited to template data (C:L), (6) No integrity or availability impact (I:N, A:N). The score is suppressed from higher severity because the flaw is read-only and does not affect system availability or allow modification of repositories or code.

Frequently asked questions