Is CVE-2026-57897 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57897 being exploited in the wild.

How severe is CVE-2026-57897?

Medium severity, with a CVSS score of 6.5, published 21 July 2026.

Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Is there a fix for CVE-2026-57897?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57897 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-57897?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57897: Gitea information disclosure in organization Actions API

Q: Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Q: Is there a fix for CVE-2026-57897?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57897 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-57897?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57897 · Severity: medium · CVSS 6.5 · Published 2026-07-21

Gitea is a self-hosted service for managing software code and automated workflows. A security flaw in the organization-level management interface allows any member of an organization to view details about automated tasks (Actions) across all projects within that organization. This includes private projects that the user should not be able to see, potentially exposing sensitive information like internal project names, commit messages, and contributor identities.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-57897 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57897 being exploited in the wild.
How severe is CVE-2026-57897?: Medium severity, with a CVSS score of 6.5, published 21 July 2026.
Which products and versions are affected?: Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-57897?: Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57897 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-57897?: Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.27.0 or later
```
go get code.gitea.io/gitea@v1.27.0
```
gitea.dev (Go): upgrade to 1.27.0 or later
```
go get gitea.dev@v1.27.0
```

Technical details

A Broken Object Property Level Authorization (BOPLA) vulnerability exists in Gitea's organization-level Actions REST endpoints (`/api/v1/orgs/{org}/actions/runs` and `/api/v1/orgs/{org}/actions/jobs`). The root cause is a missing per-repository access control check in the `shared.ListRuns` and `shared.ListJobs` handlers. While the API correctly verifies organization membership, the underlying database queries only filter by organization ID without joining against user permission tables. An authenticated attacker with basic organization membership can enumerate workflow runs, job statuses, commit SHAs, and branch names for every private repository in the organization, even those they are explicitly restricted from accessing. This issue is addressed in Gitea version 1.27.0.

Affected products

Gitea Gitea < 1.27.0

Identifiers

CVE-2026-57897
GHSA-frpw-3h2q-4jj6
GO-2026-6054

Timeline

2026-05-24: disclosed: Vulnerability reported by Prakhar Porwal
2026-07-13: advisory: GitHub Advisory published
2026-07-21: patched: Fix released in version 1.27.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.