Skip to content
Heist/ feed
Back to feed
High

Gitea Composer package source links use insufficient permission checks

Type: advisorySources: OSV

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-27771
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 11:34 UTC · Revision 1

Source evidence

Gitea Composer package source links use insufficient permission checks

core-osv · Original source

Published 3 Jul 2026, 20:19 UTC

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

osv:CVE-2026-27771
Complete source record
{
  "id": "a9ea3b92eec3f5cbe2e0c0e7d3a3fbcae5baa57c489c363b544db766c2cd31d4",
  "url": "https://osv.dev/vulnerability/CVE-2026-27771",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Gitea Composer package source links use insufficient permission checks",
    "summary": "Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.",
    "evidence": "osv:CVE-2026-27771",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-27771",
      "aliases": [
        "CVE-2026-27771",
        "GHSA-8qw8-rq86-9pc2",
        "GO-2026-6017"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/go-gitea/gitea",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2c749ce548b1da0a52835861a87b888e67842d29"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.26.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "2c749ce548b1da0a52835861a87b888e67842d29"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.26.2"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.26.1",
            "v1.26.0",
            "v1.26.0-rc0",
            "v1.27.0-dev",
            "v1.26.0-dev",
            "v1.25.0-dev",
            "v1.24.0-dev",
            "v1.22.0-rc1",
            "v1.23.0-dev",
            "v1.22.0-rc0",
            "v1.21.0-rc0",
            "v1.22.0-dev",
            "v1.20.0-rc0",
            "v1.21.0-dev",
            "v1.20.0-dev",
            "v1.19.0-rc0",
            "v1.18.0-rc0",
            "v1.19.0-dev",
            "v1.18.0-dev",
            "v1.17.0-dev",
            "v1.16.0-rc1",
            "v1.15.0-rc1",
            "v1.16.0-dev",
            "v1.15.0-dev",
            "v1.14.0-dev",
            "v1.13.0-dev",
            "v1.12.0-dev",
            "v1.10.5",
            "v1.11.0-rc1",
            "v1.10.0-rc1",
            "v1.11.0-dev",
            "v1.9.0-rc1",
            "v1.10.0-dev",
            "v1.9.0-dev",
            "v1.7.0-dev",
            "v1.6.0-rc1",
            "v1.6.0-dev",
            "v1.5.0-rc1",
            "v1.5.0-dev",
            "v1.1.0",
            "v1.0.0",
            "v0.9.99"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27771.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:34.674471185Z",
      "provider": "osv",
      "references": [
        "https://blog.gitea.com/release-of-1.26.2/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27771.json",
        "https://github.com/go-gitea/gitea/releases/tag/v1.26.2",
        "https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-27771",
        "https://github.com/go-gitea/gitea/pull/37610"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-862"
        ],
        "cna_assigner": "Gitea",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27771.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-27771",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 502070,
  "published_at": "2026-07-03T20:19:36.924+00:00"
}