Gitea Composer package source links use insufficient permission checks (Gitea Gitea Open Source Git Server)
En bref
- Source
- NVD
- EPSS
- EPSS 1.39 % · centile 72 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Gitea
- Statut NVD
- Deferred
Rechercher sur…
Description
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.
Faiblesses (CWE)
- CWE-862 — Autorisation absente
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.2 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | Gitea |
| CVSS 3.0 | HIGH 8.2 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | NVD · 88ee5874-cf24-4952-aea0-31affedb7ff2 (Secondary) |
Avis
- GHSA-8qw8-rq86-9pc2 — Gitea has insufficient permission checks for Composer package source links
- GO-2026-6017 — Gitea has insufficient permission checks for Composer package source links in code.gitea.io/gitea
Références européennes
- ENISA EUVD · EUVD-2026-41635
- GCVE · GCVE-0-2026-27771
Produits affectés
| Produit | Versions |
|---|---|
| Gitea · Gitea Open Source Git Server | affected 0 ≤ 1.26.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |