CVE-2026-79960

Gitea: incorrect authorisation

Risk score: 45/100
CVSS: 7.1 v3.1
Exploit chance (30 days): 0.2%
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and change repository visib…
Affected: Gitea
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Gitea: Amber, patch this week. Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pull_request activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow def…

The flaws

CVE-2026-79960: Incorrect authorisation (CVSS 7.1 · EPSS 0%)
CVE-2026-94205: Incorrect authorisation (CVSS 9.8 · EPSS 0%)
CVE-2026-60004: Gitea Code Injection Vulnerability (exploited)
CVE-2026-73278: Authentication bypass (CVSS 9.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Gitea

Where it stands

Exploited in the wild
On CISA's exploited list since 25 Aug
US federal deadline 28 Aug

How it unfolded

25 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
28 Aug, Deadline (official): US federal agencies must have patched

Connects to

Same weakness: Incorrect authorisation (CWE-863). 335 other warnings in 30 days
Same product: Earlier Gitea warnings. 25 in the last 90 days

Why it is Yellow

CVSS 7.1 high

References

Original description

When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and change repository visibility through push options, for example making a private repository public. Pull requests created through the AGit flow with a deploy key were also attributed to the owner.

Last activity 6 Oct 2026. Patch Forecast updates every hour.