Gitea Container Registry Authentication Bypass Vulnerability

Gitea contains a high-severity authentication bypass vulnerability affecting the built-in container and package registry functionality. CVE-2026-27771 allows unauthenticated remote attackers to retrieve private container images and package artifacts without valid credentials due to missing access control enforcement in OCI-backed registry requests. The vulnerability impacts self-hosted Gitea deployments prior to version 1.26.2 and is particularly dangerous for organizations storing proprietary code, internal dependencies, credentials, or build artifacts within private registries.

Technical Details

Gitea is a self-hosted Git service that includes built-in package and container registry functionality supporting formats such as Composer, npm, Maven, and OCI-compatible container images.

CVE-2026-27771 stems from a permission check failure in the handling of package source and registry requests. The vulnerable implementation fails to properly enforce authentication and authorization controls when serving private OCI-backed container artifacts.

An unauthenticated attacker can issue standard Docker or OCI pull requests directly against the registry API and retrieve container images marked as private without valid credentials, tokens, or prior access.

Successful exploitation may expose:

• Proprietary source code
• Internal build artifacts
• Secrets embedded in containers
• Infrastructure configuration data
• Private dependencies
• Software supply chain components

The vulnerability carries a CVSS score of 8.2 and represents a significant software supply chain exposure risk for organizations relying on self-hosted Gitea environments.

Stop Guessing, Start Proving