CVE-2026-27771 – Gitea Open Source Git Server
“A missing permission check can expose information that was never meant to leave the repository.”
This patch addresses CVE-2026-27771, a Broken Authorization vulnerability (CWE-862) affecting Gitea Open Source Git Server versions up to and including 1.26.1. The CVSS score is 8.2, which is High severity. No verified real-world exploitation has been reported.
The vulnerability is caused by insufficient permission checks for Composer package source links, which can expose private or internal package source information to unauthorized users. Successful exploitation could reveal sensitive repository metadata and internal package details that should remain restricted. While the vulnerability is not identified as Remote Code Execution (RCE), it has Elevation of Privilege (EoP) characteristics because it allows unauthorized access to protected information. Organizations running affected Gitea versions should upgrade to a fixed release to restore proper access controls.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-862