CVE-2026-27771

HighCVSS 8.2/10Last modified Oct 25, 2026

Description

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

Metrics

CVSS 3.0 8.2/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Gitea	Gitea Open Source Git Server	<= 1.26.1

References

Timeline

Published: Jul 3, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-277729.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate CVE-2026-277735.3Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-277746.7Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before buil CVE-2026-277758.8Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch ma CVE-2026-277768.8IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only when IM-LogicDesign CVE-2026-277776.5Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-277787.5The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting m CVE-2026-277797.5Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL CVE-2026-277810.0Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox CVE-2026-277809.8Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to CVE-2026-277813.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-277834.3Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.