Cyber Resilience

CVE-2026-26231

High

Published: 03 July 2026

Published
03 July 2026
Modified
03 July 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
EPSS Score 0.0003 8.6th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-26231 is a high-severity Incorrect Authorization (CWE-863) vulnerability. Its CVSS base score is 8.5 (High).

Operationally, ranked at the 8.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

No EU or UK CSIRT advisories indexed for this CVE.

Vulnerability details

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

CWE(s)
CWE-863

Related Threats

CVEs Like This One

CVE-2025-4128Shared CWE-863
CVE-2024-8116Shared CWE-863
CVE-2026-35412Shared CWE-863
CVE-2022-45172Shared CWE-863
CVE-2023-21719Shared CWE-863
CVE-2026-30229Shared CWE-863
CVE-2024-31695Shared CWE-863
CVE-2025-21553Shared CWE-863
CVE-2024-55592Shared CWE-863
CVE-2021-30205Shared CWE-863

Affected Assets

—
Gitea
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures
addresses: CWE-863

Periodic review and update of procedures reduces incorrect authorization implementations over time.

AC-13 Supervision and Review — Access Control
addresses: CWE-863

Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.

AC-16 Security and Privacy Attributes
addresses: CWE-863

Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.

AC-17 Remote Access
addresses: CWE-863

The authorization process and usage restrictions help prevent incorrect authorization for remote access types.

AC-18 Wireless Access
addresses: CWE-863

Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.

AC-19 Access Control for Mobile Devices
addresses: CWE-863

Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.

AC-2 Account Management
addresses: CWE-863

Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.

AC-20 Use of External Systems
addresses: CWE-863

Ensures authorization decisions for external system use are correctly implemented and enforced.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 8 (2 rules)
  • V-248581 OL 8 must require users to provide a password for privilege escalation. via CWE-863
  • V-252656 The OL 8 operating system must not be configured to bypass password requirements for privilege escalation. via CWE-863
RHEL 7 (2 rules)
  • V-204430 The Red Hat Enterprise Linux operating system must be configured so that users must re-authenticate for privilege escalation. via CWE-863
  • V-251704 The Red Hat Enterprise Linux operating system must not be configured to bypass password requirements for privilege escalation. via CWE-863
RHEL 8 (1 rule)
  • V-251712 The RHEL 8 operating system must not be configured to bypass password requirements for privilege escalation. via CWE-863

References