EUVD-2026-41635
GHSA-8qw8-rq86-9pc2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-reachable registry disclosure with low complexity and no interaction (AV:N/AC:L/UI:N); pure confidentiality leak so C:H, I:N, A:N; PR:N kept per vendor vector though a low-privilege account may be required.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.
Articles & Coverage 1
AnalysisAI
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers read private or internal Composer package source links they should not be authorized to see, leaking internal repository/source metadata. The flaw is a missing-authorization (CWE-862) issue reported by the Gitea project itself and fixed in v1.26.2; no public exploit identified at time of analysis, and it is not listed in CISA KEV. With a CVSS 3.0 base score of 8.2 driven by high confidentiality impact, the practical effect is unauthorized disclosure of otherwise-private package sourcing information.
Technical ContextAI
Gitea is a self-hosted, lightweight Git service written in Go that includes a built-in package registry supporting multiple ecosystems, including PHP's Composer. Composer resolves dependencies via package 'source' links (metadata pointing to the underlying repository/download location for a package). The root cause is classified as CWE-862 (Missing Authorization): the code path serving Composer package source links did not correctly enforce the visibility/permission model, so source information tied to private or internal packages was returned without validating that the requester was entitled to it. The affected component is the Gitea open source Git server (cpe:2.3:a:gitea:gitea_open_source_git_server), specifically its Composer package-registry handlers.
RemediationAI
Vendor-released patch: v1.26.2 - upgrade any Gitea instance at 1.26.1 or earlier to 1.26.2 or later, which contains the fix delivered in pull request https://github.com/go-gitea/gitea/pull/37610. Follow the vendor advisory GHSA-8qw8-rq86-9pc2 and the 1.26.2 release notes (https://blog.gitea.com/release-of-1.26.2/) for upgrade guidance. If immediate upgrade is not possible, reduce exposure by disabling the Composer package registry (or the packages feature entirely) in app.ini if it is not in active use, and by restricting network access to the /packages and Composer registry endpoints to trusted, authenticated users via a reverse proxy or firewall ACL; note the trade-off that disabling packages breaks Composer dependency resolution for legitimate consumers, and proxy-level restrictions may block valid CI/CD or developer clients. Because the leaked data is source metadata for private packages, also review whether any exposed internal repository locations warrant rotation of access or relocation after patching.
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Branch-protection bypass in Gitea's self-hosted Git server (all versions before 1.26.0) allows a user with push access t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today