CVE-2026-27771

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://blog.gitea.com/release-of-1.26.2/
https://github.com/go-gitea/gitea/pull/37610
https://github.com/go-gitea/gitea/releases/tag/v1.26.2
https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Gitea hasta la 1.26.1 inclusive presentan comprobaciones de permisos insuficientes para los enlaces de origen de paquetes de Composer, lo que puede exponer información de origen de paquetes privada o interna.

Information

Published : 2026-07-03 21:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-27771

Mitre link : CVE-2026-27771

CVE.ORG link : CVE-2026-27771

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-27771", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27771", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T14:32:50.774085Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "affectedData": [{"vendor": "Gitea", "product": "Gitea Open Source Git Server", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.26.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-03T21:16:59.043", "references": [{"url": "https://blog.gitea.com/release-of-1.26.2/", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/pull/37610", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.2", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}, {"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information."}, {"lang": "es", "value": "Las versiones de Gitea hasta la 1.26.1 inclusive presentan comprobaciones de permisos insuficientes para los enlaces de origen de paquetes de Composer, lo que puede exponer informaci\u00f3n de origen de paquetes privada o interna."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2"}