high8.2
CVE-2026-27771
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package s…
Impact
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | code.gitea.io/gitea | <= 1.26.1 | 1.26.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-8qw8-rq86-9pc2
- https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2
- https://nvd.nist.gov/vuln/detail/CVE-2026-27771
- https://github.com/go-gitea/gitea/pull/37610
- https://blog.gitea.com/release-of-1.26.2
- https://github.com/go-gitea/gitea/releases/tag/v1.26.2
- https://blog.gitea.com/release-of-1.26.2/