Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-27780: Gitea pre-receive hook can miss branch-protection checks
CVE-2026-27780
CVE-2026-27780
Summary
Gitea versions before 1.26.0 have a security issue that can allow someone to push changes to a protected branch if the Gitea server receives very large input. This is a concern because it can allow unauthorized changes to be made to a project. To fix this, update to Gitea version 1.26.0 or later.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gitea | gitea open source git server | < 1.26.0 |
Original title
Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.
Original description
Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.
Vulnerability type
CWE-863
Incorrect Authorization
- https://github.com/go-gitea/gitea/pull/36963 patch
- https://github.com/go-gitea/gitea/releases/tag/v1.26.0 release-notes
- https://blog.gitea.com/release-of-1.26.0/ release-notes
Published: 3 Jul 2026 · Updated: 23 Jul 2026 · First seen: 3 Jul 2026