CVE-2026-27771

High

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private…

88ee5874-cf24-4952-aea0-31affedb7ff2·CWE-862·Published 2026-07-03

CVSS

8.2

EPSS

0.43

KEV

Exploits

Vendor statements (1)

github.com

cve.orgen

177 chars

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

OSV.deven

97 chars

Gitea has insufficient permission checks for Composer package source links in code.gitea.io/gitea

GHSAen

372 chars

### CVE Description Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. ### Summary A critical vulnerability has been discovered in Gitea. It was already reported via ([email protected]) from ([email protected]), and submitted an encrypted report.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.0	Primary	cve.org	8.2	—	—	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
3.0	Primary	cve.org	8.2	—	—	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
3.0	Secondary	ENISA EUVD	8.2	—	—	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
3.0	Secondary	NVD	8.2	3.9	4.2	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
3.1	Secondary	GHSA	8.2	—	—	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N