DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-27771: CVE-2026-27771: Authentication Bypass and Information Disclosure in Gitea Container and Composer Registries

#security #cve #cybersecurity

CVE-2026-27771: Authentication Bypass and Information Disclosure in Gitea Container and Composer Registries

Vulnerability ID: CVE-2026-27771
CVSS Score: 8.2
Published: 2026-07-17

CVE-2026-27771 represents a critical security flaw in Gitea and Forgejo (up to and including version 1.26.1) involving missing authorization checks (CWE-862). Unauthenticated remote attackers can query, enumerate, and download private container images from the OCI-compliant container registry. Additionally, unauthorized users can retrieve private or internal source repository URLs via the Composer package registry metadata API. A public proof-of-concept exists, and threat metrics indicate highly active scanning and exploitation risks.

TL;DR

Missing authorization checks in Gitea up to v1.26.1 allow unauthenticated attackers to pull private container images and expose internal Composer repository URLs. Immediate upgrade to v1.26.2 or setting REQUIRE_SIGNIN_VIEW=true is required.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862
  • Attack Vector: Network
  • CVSS Score: 8.2
  • EPSS Score: 0.40738 (98.50th Percentile)
  • Impact: Information Disclosure / Code Leakage
  • Exploit Status: Proof-of-Concept Available
  • KEV Status: Not Listed

Affected Systems

  • Gitea Open Source Git Server
  • Forgejo Git Server
  • Gitea: >= 1.17.0, <= 1.26.1 (Fixed in: 1.26.2)
  • Forgejo: <= 1.26.1 (Fixed in: 1.26.2)

Exploit Details

  • GitHub: Proof-of-Concept Python exploitation repository for CVE-2026-27771

Mitigation Strategies

  • Upgrade Gitea to v1.26.2 or higher
  • Configure REQUIRE_SIGNIN_VIEW = true in app.ini as a temporary mitigation

Remediation Steps:

  1. Locate Gitea custom configuration file (custom/conf/app.ini)
  2. In the [service] block, set REQUIRE_SIGNIN_VIEW = true
  3. Restart the Gitea server instance to apply modifications
  4. Plan and execute upgrade to v1.26.2 or later to completely patch the underlying vulnerability

References

Read the full report for CVE-2026-27771 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)