CVE-2026-27771: 
Gitea Análisis y mitigación de vulnerabilidades

CVE-2026-27771 is a missing authorization vulnerability (CWE-862) in Gitea's Composer package registry that allows unauthenticated remote attackers to access private or internal package source links and container images without credentials. It affects all Gitea Open Source Git Server versions up to and including 1.26.1, with the fix delivered in version 1.26.2. The vulnerability was published on July 3, 2026, and carries a CVSS v3.0 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is insufficient permission checking in the Composer package metadata API handler (routers/api/packages/composer/api.go). Specifically, the permission guard used HasAnyUnitAccess() instead of HasAnyUnitAccessOrPublicAccess(), which failed to account for anonymous and "everyone" access modes — meaning unauthenticated requests could bypass the check and receive Composer package source URLs that should be restricted to authorized users. The fix (PR #37610) adds proper repository permission checks before returning Composer source fields and introduces private/internal visibility labels for packages (GitHub PR). No authentication or special privileges are required to exploit this flaw, and exploitation is fully automatable over the network (Feedly).

An unauthenticated attacker can enumerate and access private or internal Composer package source links, exposing repository URLs, package metadata, and — based on public exploit code — private container images stored in the Gitea container registry. Reports indicate approximately 30,000 Gitea deployments were potentially exposed, with the flaw reportedly present for approximately four years before disclosure (SecurityWeek, TechTimes). The confidentiality impact is high (private source and image data exposed), integrity impact is low, and there is no availability impact (GitHub Advisory).

1. Reconnaissance: Use Shodan, Censys, or similar tools to identify internet-facing Gitea instances running version 1.26.1 or earlier. The Gitea version is often disclosed in HTTP response headers or the web UI footer.
2. Identify Composer package endpoints: Query the Gitea Composer package API endpoint (e.g., GET /api/packages/{owner}/composer/packages.json) without providing any authentication credentials.
3. Extract private source links: Parse the returned JSON metadata response; due to the missing permission check, the source fields containing private repository URLs are returned even for private/internal packages.
4. Enumerate private container images: Using the public exploit script (CVE-2026-27771-exploit.py), run scan <gitea-url> to discover private repositories and pull <gitea-url> to download private container images without credentials.
5. Exfiltrate data: Extract proprietary source code references, internal package metadata, or container image contents for further reconnaissance or lateral movement (Feedly, GitHub PoC).

• Network: Unauthenticated HTTP GET requests to /api/packages/{owner}/composer/packages.json or similar Composer API endpoints from unexpected or external IP addresses; repeated requests to container registry API endpoints without Authorization headers.
• Logs: Gitea access logs showing anonymous (no user) requests successfully returning 200 responses for Composer package metadata endpoints that should require authentication; high-volume scanning patterns against package API paths from a single source IP.
• File System: Unexpected downloads of container image layers (OCI blobs) from the Gitea container registry without corresponding authenticated sessions.
• Process/Behavioral: Sudden spikes in outbound data transfer from the Gitea server corresponding to container image pulls; automated sequential requests across multiple package namespaces consistent with scanning tool behavior (Feedly, Orca Security).

Upgrade Gitea to version 1.26.2 or later, which includes the fix for this vulnerability via PR #37610 (Gitea Release, Gitea Blog). As a network-level workaround prior to patching, restrict access to Gitea package API endpoints (particularly /api/packages/) using a reverse proxy or firewall rules to limit exposure to trusted networks only. Additionally, audit which Composer package sources and container registries are currently exposed through your Gitea instance and review access logs for signs of unauthorized enumeration.

The vulnerability received significant media coverage, with The Hacker News, SecurityWeek, GBHackers, and CyberSecurityNews all reporting on the flaw and its potential impact on approximately 30,000 Gitea deployments (The Hacker News, SecurityWeek). Orca Security published a dedicated technical blog post analyzing the container registry exposure aspect of the vulnerability (Orca Security). The self-hosted community on Reddit actively discussed the issue, with posts urging users to update both Gitea and Forgejo (a Gitea fork) immediately (Reddit r/selfhosted). Horizon3.ai also published attack research on the vulnerability, and a researcher blog post (sdomi.pl) offered critical commentary on the disclosure and response process (Horizon3.ai).