Executive brief
Gitea is a Git repository hosting platform used to manage source code. In versions before 1.26.0, the system fails to properly validate oversized input in pre-receive hooks, allowing an attacker to bypass branch protection rules and push directly to protected branches without authorization. This could lead to unauthorized code changes, malicious commits, or data corruption in critical repositories.
Technical details
The vulnerability is an authorization bypass (CWE-863) affecting Gitea's pre-receive hook processing logic. When the bufio.Scanner encounters an oversized input that exceeds its buffer limits, the application fails to handle the scanner error and instead silently continues processing. This causes the branch protection validation checks to be skipped, allowing an attacker with repository push access to bypass protection rules and push to otherwise protected branches without meeting enforcement criteria. The vulnerability requires network access to a Gitea instance but does not require elevated privileges or user interaction. An attacker can exploit this by crafting oversized git push operations. The fix was released in Gitea 1.26.0 (merged March 24, 2026) and patches the error handling to fail closed when scanner errors occur.
Affected products
- Gitea Gitea < 1.26.0
Timeline
- 2026-07-03: disclosed: Published to GitHub Advisory Database and NVD
- 2026-04-18: patched: Fixed in Gitea v1.26.0 release
- 2026-03-24: other: Fix merged in pull request #36963