Vulnerability Intelligence Report
Gitea Composer package source links use insufficient permission checks
CVE-2026-27771
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.
Nuclei Template
CVSS Base Score
8.2
HIGH
Exploitability:3.9
Impact Score:4.3
EPSS Probability:40.74%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-862 ↗Missing Authorization
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Gitea | Gitea Open Source Git Server | 0 <= 1.26.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Gitea Limited · Open Source · China |
| Reserved | 2026-03-03T03:25:50 |
| Published | 2026-07-03T20:19:36 |
| Last Updated | 2026-07-07T16:58:45 |
Community Chatter & Buzz