Executive brief
Gitea, a popular self-hosted software development service, contains a security flaw in how it handles Composer package links. This vulnerability allows unauthorized individuals to view sensitive information about private or internal software packages. This could lead to the exposure of proprietary source code locations or internal infrastructure details, potentially aiding further targeted attacks.
Technical details
A missing authorization vulnerability (CWE-862) exists in Gitea's Composer package registry implementation. Due to insufficient permission checks, the system fails to properly restrict access to package source links. An unauthenticated remote attacker can exploit this over the network to view metadata and source locations for private or internal packages. This exposure can leak sensitive repository URLs and internal configuration details. The issue is addressed in Gitea version 1.26.2.
Affected products
- Gitea Gitea <= 1.26.1
Timeline
- 2026-06-05: disclosed: Initial disclosure to vendor
- 2026-07-03: advisory: NVD publication date
- 2026-07-17: advisory: GitHub Advisory Database publication date
- 2026-07-17: patched: Release of version 1.26.2