GitHub Advisoryadvisory · Go

GHSA-8qw8-rq86-9pc2 Gitea has insufficient permission checks for Composer package source links

HIGH Published 2026-07-17 Modified 2026-07-17 Official page ↗
Aliases
CVE-2026-27771
Ecosystem
Go
Packages
code.gitea.io/gitea
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-862
Reviewed
2026-07-17

Affected packages

• Go code.gitea.io/gitea: < 1.26.2 → fixed in 1.26.2

Description

CVE Description Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. Summary A critical vulnerability has been discovered in Gitea. It was already reported via ([email protected]) from ([email protected]), and submitted an encrypted report.

Related

Alias · CVE (1)

  • CVE-2026-27771 Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References