Gitea EUVD-2026-41635

Exploitation requires that the target Gitea instance (version ≤ 1.26.1) has the Composer package registry in use and hosting private or internal packages whose source links are the exposed data; against such a configuration the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no user interaction and low complexity. Limiting factors: instances that do not use the Composer registry, or that host no private/internal packages, have nothing to leak; and despite PR:N in the provided vector, the 'insufficient permission checks' wording suggests exploitation may in practice require reaching authenticated registry endpoints, so a low-privilege account could be a de facto prerequisite - verify against the vendor advisory before assuming fully anonymous access.

The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, score 8.2) portrays an easy, network-reachable, unauthenticated information disclosure with high confidentiality impact - a genuinely attractive profile because there are no complexity or interaction barriers. Counterbalancing signals lower the urgency: there is no CISA KEV listing (not confirmed actively exploited) and no public exploit code identified, so this is not currently a mass-exploitation event. The impact is disclosure of package source information rather than code execution or data destruction (I:L, A:N), which caps real-world severity below the 8.2 headline. One caveat worth verifying: the tag labels this an 'Authentication Bypass' and PR:N implies no authentication, yet 'insufficient permission checks' for 'private or internal' resources often implies an authenticated-but-under-privileged actor accessing another tenant's data - if exploitation actually requires a low-privilege account, effective PR would be PR:L and the real-world reach narrower than PR:N suggests. No EPSS score or SSVC decision data was provided in the input, so automatability and exploitation-status framing cannot be independently confirmed.

An attacker with network access to a vulnerable Gitea instance queries the Composer package registry endpoints and receives source links for packages marked private or internal, without holding the permissions those resources require. This yields internal repository/source locations and package sourcing details that can inform further reconnaissance against the organization's private code. No public proof-of-concept was identified, and the low attack complexity (AC:L) means such requests require no special timing or preconditions once the endpoint is reachable.