Insecure API Client Configuration in Gitea Product by Gitea
CVE-2026-54481

7.5HIGH

Key Information:

Vendor

Gitea

Status
Gitea Open Source Git Server
Vendor
CVE Published:
13 August 2026

What is CVE-2026-54481?

Gitea's internal API HTTP client is designed with a critical security flaw that hardcodes the InsecureSkipVerify setting to true. This configuration allows for the possibility of man-in-the-middle attacks, as SSL certificate verification is bypassed. Such an oversight leaves the system vulnerable to potential eavesdropping and data manipulation. Users of Gitea are strongly urged to review their configurations and apply necessary updates to mitigate risks associated with insecure API client settings.

Affected Version(s)

Gitea Open Source Git Server 0 <= 1.26.4

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/releases/tag/v1.27.0
release-notes
https://blog.gitea.com/gitea-1.27.0-is-released/
release-notes

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sanil18
.