Gitea 1.26.2 Security Advisory: Multiple CVE Fixes for Auth and API

Vulnerability Overview Gitea version 1.26.2 has been released, containing multiple security fixes and stability improvements. The primary vulnerabilities include: 1. CVE-2026-27783: Fixes a read permission issue. 2. CVE-2026-25714: Unifies public token filtering in API query and repository access checks. 3. CVE-2026-20706: Adds missing token scope checks. 4. CVE-2026-28744: Fixes the Smart HTTP request range error. 5. CVE-2026-28699: Fixes a basic authentication error. 6. CVE-2026-26231: Fixes the permission check allowing maintainers to edit. 7. CVE-2026-27771: Adds tags for private and internal packages and fixes the permission check for Composer package sources. Affected Scope These vulnerabilities impact multiple aspects of Gitea, including: Permission Management: Read permissions, token scope checks, and basic authentication. API and Repository Access: Public token filtering, API queries, and repository access checks. HTTP Request Handling: Smart HTTP request range errors. Package Management: Tagging and permission checks for private and internal packages. Remediation 1. CVE-2026-27783: Fixes the read permission issue (#37769, #37781). 2. CVE-2026-25714: Unifies public token filtering in API query and repository access checks (#37118). 3. CVE-2026-20706: Adds missing token scope checks (#37735). 4. CVE-2026-28744: Fixes the Smart HTTP request range error (#37583). 5. CVE-2026-28699: Fixes the basic authentication error (#37503). 6. CVE-2026-26231: Fixes the permission check allowing maintainers to edit (#37479, #37484). 7. CVE-2026-27771: Adds tags for private and internal packages and fixes the permission check for Composer package sources (#37610). Proof of Concept (POC) or Exploit Code No specific POC code or exploit code is provided in this document. Summary Gitea version 1.26.2 has been released, addressing multiple security vulnerabilities related to permission management, API and repository access, HTTP request handling, and package management. It is recommended that all users upgrade to this version to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

Gitea 1.26.2 Security Advisory: Multiple CVE Fixes for Auth and API