Skip to main content

Breaking cybersecurity news

Vulnerability database

EU vulnerability data

Hands-on web security training

Security incidents database

Knowledge library

Analytics & trends

Follow us

Professional cybersecurity intelligence

Breaking cybersecurity news

Vulnerability database

EU vulnerability data

Hands-on web security training

Security incidents database

Knowledge library

Analytics & trends

Follow us

About Sources Sponsored Articles Status Legal Terms

v2.3.4•© 2026

Telegram Bluesky GitHub Contact

Return to CVE list

CVE-2026-27771

CVE-2026-27771

8.2

High

Published:3 Jul 2026

Last updated:7 Jul 2026

Source:88ee5874-cf24-4952-aea0-31affedb7ff2

Deferred

Weakness (CWE)

CWE-862Missing Authorization

CVSS Vector

v3.0

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: Low
Availability: None

View on MITRE Find PoC on GitHub

Description

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

References

88ee5874-cf24-4952-aea0-31affedb7ff2

https://blog.gitea.com/release-of-1.26.2/

88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/pull/37610

88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/releases/tag/v1.26.2

88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2