CVE-2026-27771

Published: Jul 3, 2026Modified: Jul 7, 2026Deferred

8.2

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.2

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2 (Secondary)

Description

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://blog.gitea.com/release-of-1.26.2/

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/pull/37610

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/releases/tag/v1.26.2

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

Timeline

No history available yet.