CVE-2026-66849

Deferred Deferred - Pending Action

Gitea Package Registry Unauthorized Access via Limited-Visibility Bypass

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects user-owned package registries and exposes package contents across the intended authorization boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-66849

EUVD

EUVD-2026-101086

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows restricted users to bypass visibility settings and access packages owned by users with limited-visibility settings. The issue occurs because the package-registry access check fails to exclude restricted accounts, enabling them to enumerate and download all packages in the registry despite intended access restrictions.

Detection Guidance

To detect this vulnerability, check if restricted users can access packages owned by limited-visibility users in Gitea's package registry. Review Gitea logs for unauthorized package enumeration or download attempts by restricted accounts. Verify if the determineAccessMode function applies restricted-user checks correctly in user-owned package registries.

Impact Analysis

Attackers with limited access could escalate privileges or access unintended resources, breaching confidentiality and integrity of Gitea instances. Sensitive package contents, including Docker, npm, and PyPI packages, may be exposed to unauthorized users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing confidential package contents to restricted users.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately to apply the security patches. Ensure restricted-user visibility rules are enforced in package access checks. Review and restrict token scopes to prevent unauthorized access to limited resources.

Hi! I’m here to help you understand CVE-2026-66849. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70