CVE-2026-26231

Summary

Gitea before 1.26.2 has an authorization bypass in its "Allow edits from maintainers" pull-request feature (CVE-2026-26231). The maintainer edit permission was not properly scoped, so a user could push unauthorized commits to any repository they could merely read. In effect, read access to a repo could be turned into write access through a crafted pull request.

How to fix it

• Upgrade Gitea to 1.26.2 or later, which adds the missing authorization check.
• Audit affected repositories for unexpected commits made through pull requests during the exposure window, and review your maintainer-edit settings.
• If you cannot upgrade immediately, restrict who can open pull requests and tighten repository read access.

How to avoid it in your code

• Enforce authorization on every write path, including indirect ones like maintainer edits, fork syncs, and merge actions; never infer write rights from read access.
• Apply least-privilege repository permissions and keep read and write grants explicit and separate.
• Keep self-hosted forge software (Gitea, Forgejo, GitLab) patched promptly; code-hosting platforms are high-value targets.

References

• https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r
• https://nvd.nist.gov/vuln/detail/CVE-2026-26231
• https://github.com/go-gitea/gitea