CVE-2026-27771

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.2 Forgejo versions prior to 1.26.2

Description An access control flaw exists in the container registry and Composer package handling. The issue allows unauthenticated remote attackers to pull private container images and view private or internal Composer package source links. This occurs because the system fails to properly enforce the private flag and lacks sufficient permission checks when rendering or serving package source metadata. An attacker can exploit this by querying Composer package endpoints or sending standard anonymous Docker/OCI pull requests to the registry API. This flaw persisted for nearly four years and potentially affects over 30,000 deployments worldwide, including approximately 4,000 production systems on major cloud platforms. Exposure of this data can lead to the disclosure of sensitive information, such as source code, secrets, and internal infrastructure details.

Recommendations Update Gitea to version 1.26.2. Update Forgejo to version 1.26.2. As a temporary workaround, enable the REQUIRE SIGNIN VIEW configuration setting to enforce authentication for all content access.