4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27783

CVE-2026-27783: Gitea issue-template APIs bypass repository unit authorization

Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27783

CVE-2026-27783:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.gitea.io/gitea	go	<= 1.26.1	1.26.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a missing authorization check on three API endpoints related to issue templates and configuration in Gitea. The advisory explicitly points out that the reqRepoReader(unit.TypeCode) middleware is missing from the routes defined in routers/api/v1/api.go. The patch 6d2b02dac112ccb0fa6b70ffb9a2502c3b606727 confirms this by adding the missing middleware to the three vulnerable routes. The functions repo.GetIssueTemplates, repo.GetIssueConfig, and repo.ValidateIssueConfig are the handlers for these routes. When the vulnerability is exploited, these are the functions that would be present in a runtime profile or stack trace, as they are executed without the proper authorization checks. These functions proceed to read files from the repository's code tree, which should not be accessible to users without the Code repository unit permission. Therefore, these three handlers are the directly vulnerable functions.

Vulnerable functions

repo.GetIssueTemplates

routers/api/v1/repo/repo.go

This function is the handler for the `/issue_templates` API endpoint. The vulnerability exists because the route definition in `routers/api/v1/api.go` was missing the `reqRepoReader(unit.TypeCode)` middleware, which is responsible for checking if the user has `Code` unit permissions. As a result, any user with access to any single unit of a private repository (e.g., Issues) could call this endpoint and read issue templates from the repository's code, bypassing the intended authorization.

repo.GetIssueConfig

routers/api/v1/repo/repo.go

This function is the handler for the `/issue_config` API endpoint. The vulnerability exists because the route definition in `routers/api/v1/api.go` was missing the `reqRepoReader(unit.TypeCode)` middleware. This allowed users without `Code` unit permissions to access the repository's issue configuration file (`issue_config.yaml`) from the default branch.

repo.ValidateIssueConfig

routers/api/v1/repo/repo.go

This function is the handler for the `/issue_config/validate` API endpoint. Similar to the other two functions, the route for this endpoint was missing the `reqRepoReader(unit.TypeCode)` authorization middleware. This allowed users without `Code` unit permissions to trigger validation of the issue configuration file, indirectly confirming its contents or structure.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.