CVE-2026-27660

EUVD-2026-41633
Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 27.53%
Common Weakness Enumeration
References
https://blog.gitea.com/release-of-1.25.5/
https://github.com/go-gitea/gitea/pull/36659
https://github.com/go-gitea/gitea/pull/36715
https://github.com/go-gitea/gitea/releases/tag/v1.25.5