ByteOS Network

NVD Vulnerability Details :

CVE-2026-27771

Received

Source-88ee5874-cf24-4952-aea0-31affedb7ff2

Published At-03 Jul, 2026 | 21:16

Updated At-03 Jul, 2026 | 21:16

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.0	8.2	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Type: Secondary

Version: 3.0

Base score: 8.2

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weaknesses

CWE ID	Type	Source
CWE-862	Secondary	88ee5874-cf24-4952-aea0-31affedb7ff2

CWE ID: CWE-862

Type: Secondary

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

References

Hyperlink	Source	Resource
https://blog.gitea.com/release-of-1.26.2/	88ee5874-cf24-4952-aea0-31affedb7ff2	N/A
https://github.com/go-gitea/gitea/pull/37610	88ee5874-cf24-4952-aea0-31affedb7ff2	N/A
https://github.com/go-gitea/gitea/releases/tag/v1.26.2	88ee5874-cf24-4952-aea0-31affedb7ff2	N/A
https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2	88ee5874-cf24-4952-aea0-31affedb7ff2	N/A