CVE-2026-70402
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access.
Published Oct 14, 2026 · updated Oct 14, 2026
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account.
Oct 14, 2026 · NIST NVD
Updated
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account.
Sources
- CVE.orgCVE-2026-70402
Official CVE identifier
cve.org - NIST NVDCVE-2026-70402
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable
nvd.nist.gov