CVE-2026-27657 is an authorization bypass vulnerability in Gitea Open Source Git Server versions before 1.25.5. It permits an unauthenticated or unauthorized user to change the primary email address of another user. This flaw compromises the integrity of user account data by allowing unauthorized modifications. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No official patch or vendor advisory detailing remediation is currently available.

An attacker exploiting this vulnerability can alter the primary email address of other users, potentially disrupting account recovery, notifications, or identity verification processes. This impacts the integrity of user account data but does not affect confidentiality or availability directly. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Gitea instance to trusted users only and monitor for suspicious account modifications. Avoid exposing the service to untrusted networks if possible.