According to the CVE description, Gitea versions up to 1.26.1 permit the Allow edits from maintainers permission path to authorize commits to repositories that a user can read but should not be able to write. This means a maintainer can push changes to any readable repository, bypassing intended write restrictions. The flaw is identified as CWE‑863, an improper authorization control that lets a legitimate user exceed their granted access level.

All releases of Gitea up to and including 1.26.1 are affected; version 1.26.2 and newer contain the fix and are not vulnerable.

The CVSS score of 8.5 indicates high severity, while the EPSS score of <1% shows a low probability of exploitation observed so far. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves any user with read access to a target repository; if the repository's "Allow edits from maintainers" option is enabled, an attacker who can compromise or create a maintainer account can commit code. The lack of public tooling or known exploits means the exploitation risk is moderate, but the high severity warrants prompt action.