Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-27771
PUBLISHED
More InfoOfficial Page
Assigner-Gitea
Assigner Org ID-88ee5874-cf24-4952-aea0-31affedb7ff2
View Known Exploited Vulnerability (KEV) details
Published At-03 Jul, 2026 | 20:19
Updated At-03 Jul, 2026 | 20:19
Rejected At-
▼CVE Numbering Authority (CNA)
Gitea Composer package source links use insufficient permission checks

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

Affected Products
Vendor
Gitea
Product
Gitea Open Source Git Server
Default Status
unaffected
Versions
Affected
  • From 0 through 1.26.1 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-862Missing Authorization
Type: CWE
CWE ID: CWE-862
Description: Missing Authorization
Metrics
VersionBase scoreBase severityVector
3.08.2HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Version: 3.0
Base score: 8.2
Base severity: HIGH
Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
reporter
DevNoScope
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2
vendor-advisory
https://github.com/go-gitea/gitea/pull/37610
patch
https://github.com/go-gitea/gitea/releases/tag/v1.26.2
release-notes
https://blog.gitea.com/release-of-1.26.2/
release-notes
Hyperlink: https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2
Resource:
vendor-advisory
Hyperlink: https://github.com/go-gitea/gitea/pull/37610
Resource:
patch
Hyperlink: https://github.com/go-gitea/gitea/releases/tag/v1.26.2
Resource:
release-notes
Hyperlink: https://blog.gitea.com/release-of-1.26.2/
Resource:
release-notes
Details not found