# CVE-2026-27780: Gitea branch protection bypass via bufio.Scanner error handling in pre-receive hooks

Source: https://junglewise.ai/threats/cve-2026-27780-gitea-branch-protection-bypass-via-bufio-scanner-error-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-27780 · Severity: critical · CVSS 9.8 · Published 2026-07-03

Gitea is a Git repository hosting platform used to manage source code. In versions before 1.26.0, the system fails to properly validate oversized input in pre-receive hooks, allowing an attacker to bypass branch protection rules and push directly to protected branches without authorization. This could lead to unauthorized code changes, malicious commits, or data corruption in critical repositories.

Technologies: [Gitea](https://junglewise.ai/threats/technologies/gitea), [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea). Vendors: [Gitea](https://junglewise.ai/threats/vendors/gitea), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-27780 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27780 being exploited in the wild.

**How severe is CVE-2026-27780?** Critical severity, with a CVSS score of 9.8, published 3 July 2026.

**Which products and versions are affected?** Gitea < 1.26.0; code.gitea.io/gitea (Go) < 1.26.0, SEMVER:introduced=0,fixed=1.26.0.

**Is there a fix for CVE-2026-27780?** Yes. code.gitea.io/gitea (Go): upgrade to 1.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27780 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-27780?** Check whether you run Gitea or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code.gitea.io/gitea (Go): upgrade to 1.26.0 or later

  ```sh
  go get code.gitea.io/gitea@v1.26.0
  ```


## Technical details

The vulnerability is an authorization bypass (CWE-863) affecting Gitea's pre-receive hook processing logic. When the bufio.Scanner encounters an oversized input that exceeds its buffer limits, the application fails to handle the scanner error and instead silently continues processing. This causes the branch protection validation checks to be skipped, allowing an attacker with repository push access to bypass protection rules and push to otherwise protected branches without meeting enforcement criteria. The vulnerability requires network access to a Gitea instance but does not require elevated privileges or user interaction. An attacker can exploit this by crafting oversized git push operations. The fix was released in Gitea 1.26.0 (merged March 24, 2026) and patches the error handling to fail closed when scanner errors occur.

## Affected products

- Gitea Gitea < 1.26.0

## Identifiers

- CVE-2026-27780
- GHSA-vhq7-fwwh-7hjf
- GO-2026-6346

## Timeline

- 2026-07-03: disclosed: Published to GitHub Advisory Database and NVD
- 2026-04-18: patched: Fixed in Gitea v1.26.0 release
- 2026-03-24: other: Fix merged in pull request #36963

## References

- [https://github.com/go-gitea/gitea/pull/36963](https://github.com/go-gitea/gitea/pull/36963)
- [https://blog.gitea.com/release-of-1.26.0](https://blog.gitea.com/release-of-1.26.0)
- [https://github.com/go-gitea/gitea/releases/tag/v1.26.0](https://github.com/go-gitea/gitea/releases/tag/v1.26.0)
- [https://github.com/go-gitea/gitea/commit/c453d09c36fad094405314dba2f370434b200711](https://github.com/go-gitea/gitea/commit/c453d09c36fad094405314dba2f370434b200711)

## Related threats

- [Gitea account takeover via OAuth2 auto-linking](https://junglewise.ai/threats/cve-2026-120263-when-oauth2-client-account-linking-is-set-to-auto-not-the)
- [Gitea limited-visibility profile disclosure via public-only token](https://junglewise.ai/threats/cve-2026-119627-the-web-profile-and-rss-atom-feed-routes-of-users-and)
- [Gitea token scope bypass in web routes](https://junglewise.ai/threats/cve-2026-119625-the-username-web-route-accepted-personal-access-tokens-over-http)
- [Gitea project boards information disclosure of private pull requests](https://junglewise.ai/threats/cve-2026-119533-repository-and-organization-project-boards-listed-the-pull)
- [Gitea API token scope bypass in repository deletion](https://junglewise.ai/threats/cve-2026-119441-delete-api-v1-orgs-org-repos-deletes-all-repositories-of-an)