Description
Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects user-owned package registries and exposes package contents across the intended authorization boundary.
Published: 2026-10-14
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized disclosure of package contents through visibility bypass
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows an authenticated user to read packages owned by users marked as Limited-visibility. A protected package registry check failed to exclude accounts with a restricted user flag, permitting enumeration and download of these packages. The result is that package data, which may include source code or secrets, is exposed beyond its intended authorization boundary, constituting an access‑control breach (CWE‑284).

Affected Systems

The product affected is Gitea. No specific version range is listed in the advisory; the included references point to the 1.27.3 release, which contains the fix.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of < 1% points to an extremely low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, further indicating limited risk. Attackers must be authenticated and have a restricted‑user account to exploit the flaw, making it a low‑to‑moderate risk scenario.

Generated by OpenCVE AI on October 15, 2026 at 19:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Gitea to version 1.27.3 or later to receive the package visibility fix
  • Review restricted‑user account settings and confirm that these accounts no longer have access to packages marked as of limited visibility
  • If upgrading immediately is not feasible, restrict authenticated users from accessing the package registry endpoint via network or application‑level controls as a temporary countermeasure

Generated by OpenCVE AI on October 15, 2026 at 19:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Gitea
Gitea gitea
Vendors & Products Gitea
Gitea gitea

Wed, 14 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Description Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects user-owned package registries and exposes package contents across the intended authorization boundary.
Title Gitea restricted-user package visibility bypass
Weaknesses CWE-284
References

Subscriptions

Gitea Gitea
cve-icon MITRE

Status: PUBLISHED

Assigner: Gitea

Published:

Updated: 2026-10-14T15:18:34.090Z

Reserved: 2026-08-13T16:50:58.695Z

Link: CVE-2026-66849

cve-icon Vulnrichment

Updated: 2026-10-14T15:18:30.566Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T15:17:21.547

Modified: 2026-10-14T16:17:50.117

Link: CVE-2026-66849

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T19:30:06Z

Weaknesses