CVE-2026-66849

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The package registry allows authenticated users to read packages owned by users with limited visibility, failing to exclude restricted accounts. This allows a restricted user to enumerate and download packages, bypassing the visibility policy and exposing package contents across the intended authorization boundary.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.