8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26231

CVE-2026-26231: Gitea maintainer-edit permissions allow unauthorized commits to readable repositories

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26231

CVE-2026-26231:

8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.gitea.io/gitea	go	<= 1.26.1	1.26.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an authenticated user with only read access to a repository to gain write access by exploiting the "Allow edits from maintainers" feature in pull requests. The core of the issue lies in the CanMaintainerWriteToBranch function, which is called during a git push to a branch that is the head of a pull request.

The exploitation process is as follows:

The attacker forks a target repository.
The attacker creates a "reverse" pull request, where the BASE branch is on their own fork, and the HEAD branch is on the upstream target repository.
The attacker enables the "Allow edits from maintainers" option on this pull request. The system at the time of PR creation did not validate if the user had the right to enable this on the HEAD repository.
The attacker then pushes a malicious commit to the HEAD branch in the upstream repository.
Gitea's pre-receive hook triggers a permission check, which calls the vulnerable CanMaintainerWriteToBranch function.
The vulnerable version of this function would check if the pusher (the attacker) has write permission on the BASE repository of the pull request. Since the BASE is the attacker's own fork, this check passes.
The push is accepted, and the attacker successfully writes to the target repository.

The patch addresses this by modifying CanMaintainerWriteToBranch. The new version adds a critical check to ensure that the original creator of the pull request had write permissions to the HEAD repository. If they did not, "maintainer edits" are disallowed, regardless of the flag's value, thus preventing the unauthorized push.

Vulnerable functions

pull_list.CanMaintainerWriteToBranch

models/issues/pull_list.go

This function was vulnerable because when 'Allow edits from maintainers' was enabled on a pull request, it only checked if the user pushing the code had write access to the pull request's *base* repository. An attacker could create a pull request with the target repository as the `HEAD` and their own fork as the `BASE`. Since they are a maintainer of their own fork (the `BASE` repo), this check would pass, allowing them to push code to the target repository (`HEAD`) without having direct write permissions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.