CVE-2026-26231

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description An authorization bypass allows any authenticated low-privilege user with read access to a repository to push arbitrary commits directly to that repository, bypassing write-access checks. This occurs when the "Allow edits from maintainers" pull request (PR) option is abused through reverse-fork PRs. Specifically, the PR-create endpoint fails to verify if the submitter has write access to the HEAD repository when allow maintainer edit=true is set. By creating a PR where the BASE is the attacker's fork and the HEAD is the upstream target, the attacker can leverage their maintainer status on the BASE repository to authorize pushes to the upstream target via the CanMaintainerWriteToBranch() function in models/issues/pull list.go. This can lead to full repository compromise, enabling users to backdoor any repository they can read, including public ones.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.