Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write. This flaw means a user with read access to a repository can splice into the commit process and make changes even when the repository is marked read‑only, effectively bypassing the intended write restrictions. The vulnerability is classified as CWE‑863, indicating improper authorization of access controls.

All releases of Gitea up to and including 1.26.1 are affected; version 1.26.2 and newer contain the fix and are not vulnerable.

The CVSS score of 8.5 indicates high severity, while the EPSS score of < 1% shows a low probability of exploitation observed so far. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves any user with read access to a target repository; if the repository's "Allow edits from maintainers" option is enabled, an attacker who can compromise or create a maintainer account can commit code. The lack of public tooling or known exploits means the exploitation risk is moderate, but the high severity warrants prompt action.