{"id":"CVE-2026-27771","title":"Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.","summary":"Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cwe":["CWE-862"],"published":"2026-07-03","updated":"2026-07-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-27771","references":[{"url":"https://blog.gitea.com/release-of-1.26.2/","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/37610","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.2","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2","label":"88ee5874-cf24-4952-aea0-31affedb7ff2"}],"tags":["nvd","exploit-available"],"epss":0.01393,"epssPercentile":0.71164,"ingestedAt":"2026-07-04T14:56:14.493Z","exploits":{"github":2,"githubRepos":["https://github.com/portbuster1337/CVE-2026-27771","https://github.com/HORKimhab/CVE-2026-27771"],"nuclei":["CVE-2026-27771"],"checkedAt":"2026-09-25T08:20:53.828Z"},"exploitAvailable":true,"slug":"CVE-2026-27771","body":"## Overview\n\nGitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":45.1,"likelihood":0.3,"exploitation":12,"ransomware":0},"changes":[{"seq":5057,"id":"CVE-2026-27771","ts":1788887230960,"field":"exploit_available","old":"false","new":"true"},{"seq":3940,"id":"CVE-2026-27771","ts":1788886361707,"field":"exploit_available","old":"true","new":"false"},{"seq":2761,"id":"CVE-2026-27771","ts":1788883028431,"field":"exploit_available","old":"false","new":"true"},{"seq":1790,"id":"CVE-2026-27771","ts":1788882431456,"field":"exploit_available","old":"true","new":"false"},{"seq":896,"id":"CVE-2026-27771","ts":1788881865373,"field":"exploit_available","old":"false","new":"true"},{"seq":171,"id":"CVE-2026-27771","ts":1787603614468,"field":"epss","old":"0.43068","new":"0.01393"}]}