Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but…

CVE-2026-26231 affects Gitea versions up to and including 1.26.1, where the 'Allow edits from maintainers' permission feature can be exploited to authorize commits to repositories that a user should only have read access to. This represents an improper access control vulnerability that allows unauthorized write operations. The vulnerability was patched in Gitea version 1.26.2. Multiple GitHub pull requests (37479 and 37484) were merged to address this issue. A security advisory was published under GHSA-mm7c-rhg6-qr4r. The flaw could allow attackers to commit malicious code to repositories they should not be able to modify. Organizations using Gitea for source code management should upgrade to version 1.26.2 immediately. The vulnerability impacts the integrity of hosted repositories and the software supply chain.