CVE-2026-27771

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27771", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-03-03T03:25:50.291Z", "datePublished": "2026-07-03T20:19:36.924Z", "dateUpdated": "2026-07-07T16:58:45.839Z"}, "containers": {"cna": {"title": "Gitea Composer package source links use insufficient permission checks", "descriptions": [{"lang": "en", "value": "Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information."}], "affected": [{"vendor": "Gitea", "product": "Gitea Open Source Git Server", "versions": [{"version": "0", "lessThanOrEqual": "1.26.1", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2", "name": "GitHub Security Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/37610", "name": "GitHub Pull Request #37610", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.2", "name": "Gitea v1.26.2 Release", "tags": ["release-notes"]}, {"url": "https://blog.gitea.com/release-of-1.26.2/", "name": "Gitea v1.26.2 Release Blog Post", "tags": ["release-notes"]}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-07-03T20:19:36.924Z"}, "credits": [{"lang": "en", "value": "DevNoScope", "type": "reporter"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-07T14:32:50.774085Z", "id": "CVE-2026-27771", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T16:58:45.839Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27771", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-07T14:32:50.774085Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T14:32:54.442Z"}}], "cna": {"title": "Gitea Composer package source links use insufficient permission checks", "credits": [{"lang": "en", "type": "reporter", "value": "DevNoScope"}], "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Gitea", "product": "Gitea Open Source Git Server", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.26.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2", "name": "GitHub Security Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/37610", "name": "GitHub Pull Request #37610", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.2", "name": "Gitea v1.26.2 Release", "tags": ["release-notes"]}, {"url": "https://blog.gitea.com/release-of-1.26.2/", "name": "Gitea v1.26.2 Release Blog Post", "tags": ["release-notes"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-07-03T20:19:36.924Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27771", "state": "PUBLISHED", "dateUpdated": "2026-07-07T16:58:45.839Z", "dateReserved": "2026-03-03T03:25:50.291Z", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "datePublished": "2026-07-03T20:19:36.924Z", "assignerShortName": "Gitea"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Gitea Open Source Git Server", "vendor": "Gitea", "versions": [{"lessThanOrEqual": "1.26.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information."}, {"lang": "es", "value": "Las versiones de Gitea hasta la 1.26.1 inclusive presentan comprobaciones de permisos insuficientes para los enlaces de origen de paquetes de Composer, lo que puede exponer informaci\u00f3n de origen de paquetes privada o interna."}], "id": "CVE-2026-27771", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27771", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-07T14:32:50.774085Z", "version": "2.0.3"}}]}, "published": "2026-07-03T21:16:59.043", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://blog.gitea.com/release-of-1.26.2/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/37610"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.2"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.26.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Gitea Open Source Git Server", "source": "cna", "vendor": "Gitea"}, "product": "gitea_open_source_git_server", "vendor": "gitea"}], "created": "2026-07-04T00:45:03.645022+00:00", "updated": "2026-08-24T16:30:07.327132+00:00", "vendors": ["gitea", "gitea$PRODUCT$gitea_open_source_git_server"]}