CVE-2026-27771CWE-862

Gitea Composer package source links use insufficient permission checks

High · published July 3, 2026

CVSS v3.0
8.2
EPSS
1%
Percentile
72.1
In the wild
Unconfirmed
What it is

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

The record
Technical detail
CVSS v3.0
8.2 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01393 · 72.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea Composer package source links use insufficient permission checks
    cvelistv5