CVE-2026-27771: Gitea Composer package source links use insufficient permission checks

High severity · published Jul 3, 2026

CVE-2026-27771

Gitea Composer package source links use insufficient permission checks

8.2

CVSS

1.4%

EPSS

On KEV

Description

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.4% · higher than 72% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Gitea Open Source Git Server · Gitea

through 1.26.1 · source: vendor

In the news

VulnerabilityHigh

Gitea Vulnerability Exposes Private Container Images without Authentication

Cybersecurity researchers have disclosed a security flaw in Gitea, an open-source, self-hosted platform for version control, that allows unauthenticated remote attackers to pull private container images from Gitea deployments without requiring an account, password, or other credentials. The vulnerability, tracked as CVE-2026-27771 (CVSS score: N/A), affects all versions of Gitea prior to 1.26.2

CVE-2026-27771

May 27, 2026·The Hacker News

Affected product

Gitea Open Source Git Server

Gitea

All Gitea Open Source Git Server CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-27771

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-27771

blog.gitea.com