{"id":"EUVD-2026-41635","enisaUuid":"43f5ec55-3d85-37da-b00b-5defb240da76","description":"Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.","datePublished":"Jul 3, 2026, 8:19:36 PM","dateUpdated":"Jul 7, 2026, 4:58:45 PM","baseScore":8.2,"baseScoreVersion":"3.0","baseScoreVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2\nhttps://github.com/go-gitea/gitea/pull/37610\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.2\nhttps://blog.gitea.com/release-of-1.26.2/\n","aliases":"CVE-2026-27771\nGHSA-8qw8-rq86-9pc2\n","assigner":"Gitea","epss":1.39,"enisaIdProduct":[{"id":"5fe10468-6937-32cf-b442-334ceb970b0b","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.1"}],"enisaIdVendor":[{"id":"85dc9036-0b7b-320e-95f8-a824a1b34590","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"413aff1b-7c04-336e-8d19-df0a15484c2f","vulnerability":{"id":"GHSA-8qw8-rq86-9pc2","description":"Gitea has insufficient permission checks for Composer package source links","datePublished":"Jul 17, 2026, 7:04:37 PM","dateUpdated":"Jul 17, 2026, 7:04:37 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27771\nhttps://github.com/go-gitea/gitea/pull/37610\nhttps://blog.gitea.com/release-of-1.26.2\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.2\n","enisa_id":"EUVD-2026-41635\n","aliases":"GHSA-8qw8-rq86-9pc2\nCVE-2026-27771\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7c990ca8-c08a-3933-a8bc-ee54cf375ffa","vulnerability":{"id":"CVE-2026-27771","description":"Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.","datePublished":"Jul 3, 2026, 8:19:36 PM","dateUpdated":"Jul 7, 2026, 4:58:45 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.0","baseScoreVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2\nhttps://github.com/go-gitea/gitea/pull/37610\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.2\nhttps://blog.gitea.com/release-of-1.26.2/\n","enisa_id":"EUVD-2026-41635\n","assigner":"Gitea","epss":1.39,"dataProcessed":"Nov 3, 2026, 7:17:20 AM","vulnerabilityProduct":[{"id":"df95cfd4-92e2-396b-a44b-871cb71829ab","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.1"}],"vulnerabilityVendor":[{"id":"d156a1c5-3e66-366b-a73b-22f2f0ae3b84","vendor":{"name":"Gitea"}}]}}],"enisaIdAdvisory":[]}