CVE-2026-26231 is an authorization vulnerability in Gitea Open Source Git Server versions up to 1.26.1. The issue arises from improper enforcement of the 'Allow edits from maintainers' permission path, which incorrectly authorizes commits to repositories where the user only has read access. This allows unauthorized write operations, violating intended access controls. The vulnerability is identified as CWE-863 and has a CVSS v3.1 base score of 8.5, indicating a high severity impact with network attack vector, low attack complexity, requiring low privileges but no user interaction, and causing a partial loss of confidentiality and a high impact on integrity without affecting availability.

The vulnerability allows users with read-only access to repositories to perform unauthorized commits, effectively escalating their privileges to write. This can lead to unauthorized code changes, potentially compromising the integrity of the repository contents. Confidentiality impact is limited, and availability is not affected. There are no known exploits in the wild at the time of this report.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor Gitea's official channels for updates and consider restricting repository access permissions until a fix is available.