CVE-2026-27783 identifies a missing authorization check in Gitea versions <=1.26.1 on the issue-template API endpoints. This means that the system does not properly verify whether a user has permission to access certain repository units when interacting with issue templates. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity level, with network attack vector, low attack complexity, requiring low privileges, no user interaction, and limited confidentiality impact. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

An attacker with low privileges could access issue-template API endpoints without proper authorization, potentially exposing information related to issue templates. The confidentiality impact is low, and there is no impact on integrity or availability. This could lead to unauthorized information disclosure within the affected Gitea instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the issue-template API endpoints through access controls or network segmentation where possible. Monitor vendor communications for updates on patches or official mitigations.