CVE-2026-27771

EUVD-2026-41635
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.2 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://blog.gitea.com/release-of-1.26.2/
https://github.com/go-gitea/gitea/pull/37610
https://github.com/go-gitea/gitea/releases/tag/v1.26.2
https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2