Email Address Manipulation in Gitea by Gitea
CVE-2026-27657

Currently unrated

Key Information:

Vendor: Gitea
Status: Gitea Open Source Git Server
Vendor: CVE Published:; 3 July 2026

What is CVE-2026-27657?

Versions of Gitea before 1.25.5 are susceptible to a vulnerability that allows users to change the primary email address of other users. This unauthorized modification can lead to various security issues, including potential account takeovers and phishing attacks. The Gitea team has addressed this vulnerability in version 1.25.5, which can be reviewed in their release notes.

Affected Version(s)

Gitea Open Source Git Server 0 < 1.25.5

References

https://github.com/go-gitea/gitea/pull/36586

patch

https://github.com/go-gitea/gitea/pull/36607

patch

https://github.com/go-gitea/gitea/releases/tag/v1.25.5

release-notes

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 3, 2026
Vulnerability Reserved
Feb 22, 2026

Credit

CsEnox

CVE-2026-27657 Data

JSON