Vulnerability advisory
GO-2026-6017
Gitea has insufficient permission checks for Composer package source links in code.gitea.io/gitea
Also known as CVE-2026-27771GHSA-8qw8-rq86-9pc2
Severity
Severity not reported.
Affected versions
| Affected | Fixed in |
|---|---|
| All versions before 1.26.2 | 1.26.2 |
Description
Gitea has insufficient permission checks for Composer package source links in code.gitea.io/gitea