CVE-2026-27771
published 2026-07-03CVE-2026-27771: Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package…
PriorityP272high8.2CVSS 3.0
AVNACLPRNUINSUCHILAN
EXPLOIT
EPSS
43.07%
98.6th percentile
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.26.2 | 1.26.2 |
| gitea | gitea_open_source_git_server | <= 1.26.1 | — |
Detection & IOCsextracted from sources · hover to see the quote
urlGET /v2/ HTTP/1.1
url/v2/_catalog
yara
"repositories":\s*\[".+
- →Step 1 of exploit chain: probe /v2/ endpoint — expect HTTP 401 response, confirming Gitea container registry is present.
- →Step 2 of exploit chain: request an unauthenticated token from /v2/token with wildcard scope to obtain a Bearer token without credentials.
- →Step 3 of exploit chain: use the unauthenticated Bearer token to enumerate all repositories via /v2/_catalog; a 200 response with a non-empty 'repositories' array confirms exploitation.
- →Unauthenticated remote attackers can pull private container images from Gitea deployments without requiring an account, password, or other credentials. ↗
- →Forgejo (a Gitea fork) has been independently confirmed to be impacted; treat all Gitea forks as potentially vulnerable until verified. ↗
- ·Temporary workaround: set REQUIRE_SIGNIN_VIEW=true in gitea app.ini to block unauthenticated access, but note this also blocks all anonymous access including intentionally public repositories.
- ·The workaround of setting [service].REQUIRE_SIGNIN_VIEW=true is not ideal if some containers are meant to be intentionally exposed publicly. ↗
- ·The vulnerability affects all Gitea versions prior to 1.26.2; the NVD description references Composer package source links while the researcher report describes container registry image pull — treat scope as container registry auth bypass (CWE-862). ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea has insufficient permission checks for Composer package source links
ghsa·2026-07-17
CVE-2026-27771 [HIGH] CWE-862 Gitea has insufficient permission checks for Composer package source links
Gitea has insufficient permission checks for Composer package source links
### CVE Description
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.
### Summary
A critical vulnerability has been discovered in Gitea. It was already reported via ([email protected]) from ([email protected]), and submitted an encrypted report.
VulDB
Gitea up to 1.26.1 authorization (GHSA-8qw8-rq86-9pc2)
vuldb·2026-07-04·CVSS 8.2
CVE-2026-27771 [HIGH] Gitea up to 1.26.1 authorization (GHSA-8qw8-rq86-9pc2)
A vulnerability has been found in Gitea up to 1.26.1 and classified as critical. Affected by this issue is some unknown functionality. This manipulation causes missing authorization.
This vulnerability is tracked as CVE-2026-27771. The attack is possible to be carried out remotely. No exploit exists.
The affected component should be upgraded.
No detection rules found.
Nuclei
Gitea Container Registry - Unauthorized Private Image Access
nuclei·CVSS 7.5
CVE-2026-27771 Gitea Container Registry - Unauthorized Private Image Access
Gitea Container Registry - Unauthorized Private Image Access
Gitea = 1.26.2. As a temporary workaround, set REQUIRE_SIGNIN_VIEW=true in gitea app.ini, though this blocks all anonymous access including public repos.
reference:
- https://blog.gitea.com/release-of-1.26.2/
- https://github.com/go-gitea/gitea/pull/37290
- https://github.com/go-gitea/gitea/pull/37610
- https://orca.security/resources/blog/gitea-container-registry-vulnerability/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2026-27771
cwe-id: CWE-862
metadata:
verified: true
max-request: 2
vendor: gitea
product: gitea
shodan-query: http.html:"Gitea"
fofa-query: app="Gitea"
tags: cve,cve2026,gitea,container,registry,auth-bypass,unauth
flow: http(1) && http(2) && http(3)
h
Hackernews
Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
blogs_hackernews·2026-08-05·CVSS 9.8
CVE-2026-59774 [CRITICAL] Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
An unauthenticated attacker can read any file the service account can access on Gitea , the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1.
CVE-2026-59774
CVE-2026-60004
Gitea said Cloud instances would be upgraded automatically during the release maintenance window. Self-hosted administrators should move to 1.27.1 immediately.
app.ini
INTERNAL_TOKEN
That chain is described in Gitea's advis
Hackernews
⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
blogs_hackernews·2026-08-03
CVE-2026-42897 ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
This week kept coming back to permission. A model crossed a boundary. A wallet trusted bad randomness. Webmail kept an intruder around. Public systems, package feeds, hotel networks, and login flows all gave away more than intended.
Some of it was clever. Most of it was just access left lying around: old bugs, exposed gear, poisoned dependencies, weak defaults, and tooling that moved from forum chatter to real targets.
The full weekly recap report follows.
## ⚡ Threat of the Week
Anthropic Disclosed its Models Targeted 3 O
Hackernews
⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More
blogs_hackernews·2026-06-01·CVSS 7.8
CVE-2026-0257 [HIGH] ⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More
Monday hit like a cron job with anger issues.
A busted auth path here, a repo-side faceplant there, some "patched-ish" thing already getting chewed on in the wild, and then the usual bonus round: poisoned dev tools, sketchy forum chatter, phishing kits pretending to be productivity, and AI lowering the bar for people who already thought 'curl | sh' had a personality.
The vibe is simple: old bugs, new wrappers, faster abuse. Patch the obvious crap first. Then read the rest.
## ⚡ Threat of the Week
PAN-OS GlobalProtect Authenticati
Hackernews
Gitea Vulnerability Exposes Private Container Images without Authentication
blogs_hackernews·2026-05-27
CVE-2026-27771 Gitea Vulnerability Exposes Private Container Images without Authentication
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Gitea Vulnerability Exposes Private Container Images without Authentication
Cybersecurity researchers have disclosed a security flaw in Gitea, an open-source, self-hosted platform for version control, that allows unauthenticated remote attackers to pull private container images from Gitea deployments without requiring an account, password, or other credentials.
The vulnerability, tracked as CVE-2026-27771 (CVSS score: N/A), affects all versions of Gitea prior to 1.26.2 , which addresses the issue.
According to Noscope, the security defect likely impacts more than 30,000 deployments across over 30 countries and went undetect
2026-07-03
Published