{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Gitea Open Source Git Server",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThanOrEqual": "1.26.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints."
    }
  ],
  "id": "CVE-2026-27783",
  "lastModified": "2026-07-03T21:16:59.450",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-03T21:16:59.450",
  "references": [
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "url": "https://blog.gitea.com/release-of-1.26.2/"
    },
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "url": "https://github.com/go-gitea/gitea/pull/37769"
    },
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "url": "https://github.com/go-gitea/gitea/pull/37781"
    },
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.2"
    },
    {
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-3fwp-p5rj-2pxf"
    }
  ],
  "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "88ee5874-cf24-4952-aea0-31affedb7ff2",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.26.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "code.gitea.io/gitea"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27783"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-16T23:41:42Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThree Gitea API endpoints \u2014 `GET /repos/{owner}/{repo}/issue_templates`,\n`GET /repos/{owner}/{repo}/issue_config` and `GET /repos/{owner}/{repo}/issue_config/validate`\n\u2014 read files from the repository\u0027s **Code** default branch (`.gitea/ISSUE_TEMPLATE/*`\nand `issue_config.yaml`) and return their contents, but are registered **without**\nthe `reqRepoReader(unit.TypeCode)` authorization middleware that every sibling\nCode-tree endpoint in the same route group carries.\n\nA user who has access to a private repository through *any single repository unit*\n(for example an organization team granted only the **Issues** unit, with no Code\naccess) can therefore read the issue-template and issue-config files of that\nrepository\u0027s Code tree, which their permission set should not expose.\n\n---\n\n## Root cause\n\n### The three endpoints lack the unit guard\n\n`routers/api/v1/api.go:1433-1437`:\n\n    m.Get(\"/issue_templates\", context.ReferencesGitRepo(), repo.GetIssueTemplates)\n    m.Get(\"/issue_config\", context.ReferencesGitRepo(), repo.GetIssueConfig)\n    m.Get(\"/issue_config/validate\", context.ReferencesGitRepo(), repo.ValidateIssueConfig)\n    m.Get(\"/languages\", reqRepoReader(unit.TypeCode), repo.GetLanguages)\n    m.Get(\"/licenses\", reqRepoReader(unit.TypeCode), repo.GetLicenses)\n\n`context.ReferencesGitRepo()` only opens the git repository \u2014 it performs no\npermission check. Every other endpoint in this group that reads Code-tree content\nis guarded with `reqRepoReader(unit.TypeCode)`: `/languages`, `/licenses`,\n`/contents/*`, `/file-contents`, and `/{ball_type:tarball|zipball|bundle}/*`\n(api.go:1418-1445). The three issue-template endpoints are the only Code-tree\nreaders in the group missing that guard.\n\nThe enclosing group runs `repoAssignment()` (api.go:1446), whose access check is\nsatisfied by `HasAnyUnitAccessOrPublicAccess` \u2014 i.e. access to **any** unit of the\nrepository is sufficient to pass. Without a per-unit `reqRepoReader`, the handlers\nrun for a caller who has no Code permission.\n\n### The handlers return Code-tree file contents\n\n`routers/api/v1/repo/repo.go`:\n\n    func GetIssueTemplates(ctx *context.APIContext) {                       // :1179\n        ret := issue.ParseTemplatesFromDefaultBranch(ctx.Repo.Repository, ctx.Repo.GitRepo)\n        ...\n        ctx.JSON(http.StatusOK, ret.IssueTemplates)\n    }\n\n    func GetIssueConfig(ctx *context.APIContext) {                          // :1209\n        issueConfig, _ := issue.GetTemplateConfigFromDefaultBranch(ctx.Repo.Repository, ctx.Repo.GitRepo)\n        ctx.JSON(http.StatusOK, issueConfig)\n    }\n\n`ParseTemplatesFromDefaultBranch` / `GetTemplateConfigFromDefaultBranch` read\n`.gitea/ISSUE_TEMPLATE/*` and `issue_config.yaml` from the default (Code) branch\nand return them in the JSON response.\n\n---\n\n## Proof of Concept\n\n`victim-org/private-repo` is a private repository. The attacker is a member of an\norganization team granted access to that repository through a non-Code unit only\n(e.g. the Issues unit) \u2014 a supported Gitea permission configuration.\n\n    GET /api/v1/repos/victim-org/private-repo/issue_templates HTTP/1.1\n    Host: TARGET\n    Authorization: token \u003cattacker token\u003e\n\nThe response is `200 OK` with the parsed contents of the repository\u0027s\n`.gitea/ISSUE_TEMPLATE/*` files. The same applies to `/issue_config`. Because the\ncaller lacks the Code unit, every other Code-tree endpoint\n(`/contents`, `/languages`, \u2026) correctly returns `404`/`403` for the same token \u2014\nonly these three return data.\n\n---\n\n## Impact\n\nA repository collaborator whose granted permissions exclude the Code unit can read\nthe issue-template and issue-config files from the Code default branch of a private\nrepository. The exposure is limited to those specific configuration files (not\narbitrary Code-tree content), which is why this is rated low impact. It is\nnonetheless a unit-level authorization bypass: the endpoints disclose Code-unit\ncontent to callers the permission model is meant to exclude.\n\n---\n\n## Suggested fix\n\nAdd the same unit guard the sibling endpoints use, in `routers/api/v1/api.go`:\n\n    m.Get(\"/issue_templates\", reqRepoReader(unit.TypeCode), context.ReferencesGitRepo(), repo.GetIssueTemplates)\n    m.Get(\"/issue_config\", reqRepoReader(unit.TypeCode), context.ReferencesGitRepo(), repo.GetIssueConfig)\n    m.Get(\"/issue_config/validate\", reqRepoReader(unit.TypeCode), context.ReferencesGitRepo(), repo.ValidateIssueConfig)\n\n(If issue templates are intended to be visible to Issues-unit users for issue\ncreation, `reqRepoReader(unit.TypeIssues)` is the appropriate guard \u2014 but the\ncurrent absence of any unit guard is the bug.)\n\n---\n\n## References\n\n- CWE-862 Missing Authorization\n- CWE-284 Improper Access Control\n- OWASP A01:2021 Broken Access Control",
  "id": "GHSA-3fwp-p5rj-2pxf",
  "modified": "2026-06-16T23:41:42Z",
  "published": "2026-06-16T23:41:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-3fwp-p5rj-2pxf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gitea: Missing repository-unit authorization on issue-template API endpoints"
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Gitea ist ein quelloffener Github-Klon.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um m\u00f6glicherweise erweiterte Privilegien zu erlangen, Sicherheitsma\u00dfnahmen zu umgehen oder Daten zu manipulieren und offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1637 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1637.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1637 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1637"
      },
      {
        "category": "external",
        "summary": "Gitea Release Notes vom 2026-05-21",
        "url": "https://blog.gitea.com/release-of-1.26.2"
      },
      {
        "category": "external",
        "summary": "PoC f\u00fcr CVE-2026-28744",
        "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-cc8w-r4qh-3v65"
      }
    ],
    "source_lang": "en-US",
    "title": "Gitea: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-05-25T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-26T08:05:35.400+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1637",
      "initial_release_date": "2026-05-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-05-25T22:00:00.000+00:00",
          "number": "2",
          "summary": "Exploit aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.26.2",
                "product": {
                  "name": "Open Source Gitea \u003c1.26.2",
                  "product_id": "T054482"
                }
              },
              {
                "category": "product_version",
                "name": "1.26.2",
                "product": {
                  "name": "Open Source Gitea 1.26.2",
                  "product_id": "T054482-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:gitea:gitea:1.26.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Gitea"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-20706",
      "product_status": {
        "known_affected": [
          "T054482"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-20706"
    },
    {
      "cve": "CVE-2026-25714",
      "product_status": {
        "known_affected": [
          "T054482"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-25714"
    },
    {
      "cve": "CVE-2026-26231",
      "product_status": {
        "known_affected": [
          "T054482"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-26231"
    },
    {
      "cve": "CVE-2026-27771",
      "product_status": {
        "known_affected": [
          "T054482"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-27771"
    },
    {
      "cve": "CVE-2026-27783",
      "product_status": {
        "known_affected": [
          "T054482"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-27783"
    },
    {
      "cve": "CVE-2026-28699",
      "product_status": {
        "known_affected": [
          "T054482"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-28699"
    },
    {
      "cve": "CVE-2026-28744",
      "product_status": {
        "known_affected": [
          "T054482"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-28744"
    }
  ]
}