CVE-2026-27660: Gitea draft releases use insufficient permission checks
Published Jul 3, 2026
·Updated
Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.
Affected Software
1 affected component
Gitea Gitea<1.25.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
giteato a version that resolves this vulnerability.Fixed in 1.25.5
Event History
Jul 3, 2026
CVE Published
via MITRE·08:19 PM
Data Sourced
via MITRE·08:19 PM
DescriptionWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-27660?
CVE-2026-27660 has a risk score of 45, indicating a moderate severity vulnerability.
2
How do I fix CVE-2026-27660?
To fix CVE-2026-27660, upgrade Gitea to version 1.25.5 or later, where the issue has been resolved.
3
What does CVE-2026-27660 affect?
CVE-2026-27660 affects Gitea versions prior to 1.25.5, specifically relating to draft releases and permission checks.
4
What type of vulnerability is CVE-2026-27660?
CVE-2026-27660 is a permissions vulnerability that allows unauthorized access to draft release data or attachments.
5
When was CVE-2026-27660 published?
CVE-2026-27660 was published on July 3, 2026.