Unauthorized Access Vulnerability in Gitea by Gitea
CVE-2026-25038

7.5HIGH

Key Information:

Vendor

Gitea

Status
Gitea Open Source Git Server
Vendor
CVE Published:
3 July 2026

What is CVE-2026-25038?

Gitea version 1.26.2 has a security flaw that allows unauthorized users to gain access to private organization labels. This vulnerability can lead to sensitive information exposure, impacting the confidentiality of organizational data. Users are encouraged to upgrade to the latest version 1.26.3, which addresses this issue, ensuring that only authorized users have appropriate access to labels.

Affected Version(s)

Gitea Open Source Git Server 1.26.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/38151
patch
https://github.com/go-gitea/gitea/releases/tag/v1.26.3
release-notes

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ybsun0215
.