Is CVE-2026-27780 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27780 being exploited in the wild.

How severe is CVE-2026-27780?

Critical severity, with a CVSS score of 9.8, published 3 July 2026.

Which products and versions are affected?

Gitea < 1.26.0; code.gitea.io/gitea (Go) < 1.26.0, SEMVER:introduced=0,fixed=1.26.0.

Is there a fix for CVE-2026-27780?

Yes. code.gitea.io/gitea (Go): upgrade to 1.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27780 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-27780?

Check whether you run Gitea or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27780: Gitea branch protection bypass via bufio.Scanner error handling in pre-receive hooks

Q: Which products and versions are affected?

Gitea < 1.26.0; code.gitea.io/gitea (Go) < 1.26.0, SEMVER:introduced=0,fixed=1.26.0.

Q: Is there a fix for CVE-2026-27780?

Yes. code.gitea.io/gitea (Go): upgrade to 1.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-27780 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-27780?

Check whether you run Gitea or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27780 · Severity: critical · CVSS 9.8 · Published 2026-07-03

Gitea is a Git repository hosting platform used to manage source code. In versions before 1.26.0, the system fails to properly validate oversized input in pre-receive hooks, allowing an attacker to bypass branch protection rules and push directly to protected branches without authorization. This could lead to unauthorized code changes, malicious commits, or data corruption in critical repositories.

Technologies: Gitea, code.gitea.io/gitea (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-27780 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27780 being exploited in the wild.
How severe is CVE-2026-27780?: Critical severity, with a CVSS score of 9.8, published 3 July 2026.
Which products and versions are affected?: Gitea < 1.26.0; code.gitea.io/gitea (Go) < 1.26.0, SEMVER:introduced=0,fixed=1.26.0.
Is there a fix for CVE-2026-27780?: Yes. code.gitea.io/gitea (Go): upgrade to 1.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27780 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-27780?: Check whether you run Gitea or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.26.0 or later
```
go get code.gitea.io/gitea@v1.26.0
```

Technical details

The vulnerability is an authorization bypass (CWE-863) affecting Gitea's pre-receive hook processing logic. When the bufio.Scanner encounters an oversized input that exceeds its buffer limits, the application fails to handle the scanner error and instead silently continues processing. This causes the branch protection validation checks to be skipped, allowing an attacker with repository push access to bypass protection rules and push to otherwise protected branches without meeting enforcement criteria. The vulnerability requires network access to a Gitea instance but does not require elevated privileges or user interaction. An attacker can exploit this by crafting oversized git push operations. The fix was released in Gitea 1.26.0 (merged March 24, 2026) and patches the error handling to fail closed when scanner errors occur.

Affected products

Gitea Gitea < 1.26.0

Identifiers

CVE-2026-27780
GHSA-vhq7-fwwh-7hjf
GO-2026-6346

Timeline

2026-07-03: disclosed: Published to GitHub Advisory Database and NVD
2026-04-18: patched: Fixed in Gitea v1.26.0 release
2026-03-24: other: Fix merged in pull request #36963

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.