CVE-2026-27771

Description

CVE-2026-27771 allowed unauthenticated access to private container images on Gitea instances.

Overview

State

—

Assigner (CNA)

—

CVSS severity

null

CVSS score

—

CVSS vector

null

Effective score

no score available from CNA, NVD, or AI yet

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-27771

Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.

No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-41635

Assigner

Gitea

Published

Jul 3, 2026, 8:19:36 PM

Updated

Jul 7, 2026, 4:58:45 PM

EUVD base score (CVSS 3.0)

8.2 / 10
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EUVD-reported EPSS

43.0700

Vendors

Gitea

Products

Gitea Open Source Git Server (0 ≤1.26.1)

Aliases

GHSA-8qw8-rq86-9pc2

ENISA description: Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-27771 tenable:nvd.nist.gov
• https://thehackernews.com/2026/05/gitea-vulnerability-exposes-private.html tenable:thehackernews.com
• https://www.cve.org/CVERecord?id=CVE-2026-27771 tenable:www.cve.org
• https://www.noscope.com/blog/gitea-instances-exposing-private-container tenable:www.noscope.com
• https://www.securityweek.com/gitea-vulnerability-exposed-30000-deployments-to-attacks/ tenable:www.securityweek.com

• June 2026 Critical Security Patch Update Released - Oracle Blogs
  web:blogs.oracle.com

  For more information about the Critical Security Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.

  2026-06-19 02:54 UTC
• CVE-2026-27771: Gitea Registry Authentication Bypass - What It Means ...
  web:integsec.com

  A — Technical Analysis The root cause of CVE-2026-27771 lies in missing permission checks within Gitea's handling of OCI-backed registry requests for package and container artifacts. The vulnerable component fails to enforce authentication and authorization for repositories designated as private or internal.

  2026-06-19 02:54 UTC
• Nvd - Cve-2026-2771
  web:nvd.nist.gov

  Analysis Description Undefined behavior in the DOM: Core & HTML component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

  2026-06-19 02:54 UTC
• Security Update Guide - Loading - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-06-19 02:54 UTC
• March 13, 2026—Hotpatch KB5084597 (OS Builds 26200.7982 and 26100.7982 ...
  web:support.microsoft.com

  This update for Windows 11, version 25H2 and 24H2 (KB5084597) incudes security improvements. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates. To view the ...

  2026-06-19 02:54 UTC
• SAP Security Patch Day - February 2026
  web:support.sap.com

  SAP security Patch Day Bulletin This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the Support Portal and applies patches on priority to protect their SAP landscape. On 10th of February 2026 , SAP security patch day saw the release of 26 new security notes. Further, there was 1 update to ...

  2026-06-19 02:54 UTC
• CVE-2026-27771: NoScope Discovered 30,000+ Gitea Instances Exposing ...
  web:www.noscope.com

  Blog CVE-2026-27771 : NoScope Discovered 30,000+ Gitea Instances Exposing Private Container Images for 4 Years Gitea private container images were accessible to anyone on the internet, no credentials required, across healthcare, aerospace, and critical infrastructure worldwide.

  2026-06-19 02:54 UTC
• Windows 11 February 2026 Patch: KB5077181 and KB5075941 fix zero-days ...
  web:www.notebookcheck.net

  Microsoft's February 2026 Windows 11 updates (KB5077181 and KB5075941) add security patches, bug fixes, and new Secure Boot rollout signals ahead of certificate expirations starting in June 2026 .

  2026-06-19 02:54 UTC
• Gitea Vulnerability Exposed 30,000 Deployments to Attacks
  web:www.securityweek.com

  CVE-2026-27771 , an access control vulnerability in Gitea, exposed over 30,000 deployments to unauthorized access.

  2026-06-19 02:54 UTC
• Patch Tuesday June 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-06-19 02:54 UTC

Only Available for Registered Users. Sign in to view.