x/vulndb: potential Go vuln in code.gitea.io/gitea: GHSA-x92v-f5gc-r34v

[GoVulnBot]

Advisory GHSA-x92v-f5gc-r34v references a vulnerability in the following Go modules:

Module
code.gitea.io/gitea

Description:
Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.

References:

• ADVISORY: GHSA-x92v-f5gc-r34v
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2026-27660
• FIX: go-gitea/gitea@1eced4a
• FIX: go-gitea/gitea@e7fca90
• FIX: Fix get release draft permission check go-gitea/gitea#36659
• FIX: Fix get release draft permission check (#36659) go-gitea/gitea#36715
• WEB: https://blog.gitea.com/release-of-1.25.5
• WEB: https://github.com/go-gitea/gitea/releases/tag/v1.25.5

Cross references:

• code.gitea.io/gitea appears in 68 other report(s):
  • data/reports/GO-2022-0310.yaml (x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2021-45327 #310)
  • data/reports/GO-2022-0315.yaml (x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2021-45331 #315)
  • data/reports/GO-2022-0353.yaml (x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2021-29134 #353)
  • data/reports/GO-2022-0442.yaml (x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2022-27313 #442)
  • data/reports/GO-2022-0450.yaml (x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2022-30781 #450)
  • data/reports/GO-2022-0609.yaml (x/vulndb: potential Go vuln in code.gitea.io/gitea: GHSA-jr9c-h74f-2v28 #609)
  • data/reports/GO-2022-0612.yaml (x/vulndb: potential Go vuln in code.gitea.io/gitea: GHSA-ph3w-2843-72mx #612)
  • data/reports/GO-2022-0830.yaml (x/vulndb: potential Go vuln in github.com/go-gitea/gitea: GHSA-g2qx-6ghw-67hm #830)
  • data/reports/GO-2022-0832.yaml (x/vulndb: potential Go vuln in code.gitea.io/gitea: GHSA-g95p-88p4-76cm #832)
  • data/reports/GO-2022-0844.yaml (x/vulndb: potential Go vuln in code.gitea.io/gitea: GHSA-hf6f-jq25-8gq9 #844)
  • data/reports/GO-2022-0982.yaml (x/vulndb: potential Go vuln in code.gitea.io/gitea: CVE-2021-45330, GHSA-pg38-r834-g45j #982)
  • data/reports/GO-2022-1065.yaml (x/vulndb: potential Go vuln in github.com/go-gitea/gitea: CVE-2022-42968 #1065)
  • data/reports/GO-2023-1894.yaml (x/vulndb: potential Go vuln in code.gitea.io/gitea: GHSA-cf6v-9j57-v6r6 #1894)
  • data/reports/GO-2023-1922.yaml (x/vulndb: potential Go vuln in code.gitea.io/gitea: GHSA-5rh7-6gfj-mc87 #1922)
  • data/reports/GO-2023-1971.yaml (x/vulndb: potential Go vuln in gogs.io/gogs: GHSA-fg3x-rwq9-74cw #1971)
  • ... and 53 more report(s)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: code.gitea.io/gitea
      versions:
        - fixed: 1.25.5
      vulnerable_at: 1.25.4
summary: Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea
cves:
    - CVE-2026-27660
ghsas:
    - GHSA-x92v-f5gc-r34v
references:
    - advisory: https://github.com/advisories/GHSA-x92v-f5gc-r34v
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-27660
    - fix: https://github.com/go-gitea/gitea/commit/1eced4a7c099459af42412bb32a83241650c0f8f
    - fix: https://github.com/go-gitea/gitea/commit/e7fca90a780e4d35eb1fa67b1f377ebd54e74611
    - fix: https://github.com/go-gitea/gitea/pull/36659
    - fix: https://github.com/go-gitea/gitea/pull/36715
    - web: https://blog.gitea.com/release-of-1.25.5
    - web: https://github.com/go-gitea/gitea/releases/tag/v1.25.5
source:
    id: GHSA-x92v-f5gc-r34v
    created: 2026-09-01T19:01:50.405846786Z
review_status: UNREVIEWED