Package Access Vulnerability in Gitea from Go-Gitea
CVE-2026-66849

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-66849?

A vulnerability exists in Gitea's package registry that allows authenticated users to access packages owned by limited-visibility users. This flaw allows restricted users to enumerate and download these packages, breaching the intended visibility policy. As a result, sensitive package contents could be exposed across the authorization boundary, leading to potential data leaks and unauthorized access to proprietary information.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39043
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/Black1hp
https://github.com/Mon3mRT
https://github.com/bircni
.