ANALYSIS · 6592bde9· FINISHED 2026-05-29 · PATCHDIFF

giteav1.26.1 → v1.26.2✓ COMPLETED

Files144

Vulnerable84

True positives74

CVE matched23

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-27771

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 144 CVE 23 Vuln 84

SORT

23 files · page 2/2

services/repository/push.go

AI: 1 vulnerabilities

CVE-2026-27771 1 TP

#%!d(float64=115)

tests/integration/api_issue_templates_test.go

AI: 1 vulnerabilities

CVE-2026-27771 1 FP

#%!d(float64=120)

tests/integration/api_user_public_only_test.go

AI: 2 vulnerabilities

CVE-2026-27771 2 TP

#%!d(float64=129)

21–23 of 23

« ‹ 1 2

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-27771

Security writeup for CVE-2026-27771

✓ 23 FILES

## The Exploit

A low-privilege user able to call the composer package metadata API can retrieve metadata for a private package owner.

```bash
curl -i -H "Authorization: token ATTACKER_TOKEN" \
  "https://TARGET/api/packages/victimuser/composer"
```

The attacker receives `200 OK` and JSON containing composer package metadata from `victimuser`, including source/distribution metadata that should have been restricted. On patched Gitea, the same request is rejected or filtered because the composer response helper now receives the request context and enforces permissions.

## What the Patch Did

Before:
```go
resp := createPackageMetadataResponse(setting.AppURL+"api/packages/"+ctx.Package.Owner.Name+"/composer", pds)
```

After:
```go
resp := createPackageMetadataResponse(ctx, setting.AppURL+"api/packages/"+ctx.Package.Owner.Name+"/composer", pds)
```

The fix passes the HTTP request context into `createPackageMetadataResponse`, giving the metadata builder access to authentication/authorization state. This is a context propagation fix: the helper can now decide whether the caller is allowed to see private package source metadata.

## Root Cause

This was an information disclosure bug (CWE-200): the composer package metadata endpoint built a response without supplying the request context to the helper that serializes package metadata. The attacker-controlled request arrives at `/api/packages/<owner>/composer`; the route constructs a response URL from `ctx.Package.Owner.Name` and calls `createPackageMetadataResponse(...)` without `ctx`. That helper therefore lacked the trust boundary information needed to decide if the caller was authorized for private package metadata, so it exposed sensitive source metadata regardless of visibility.

## Why It Works

The only load-bearing change is the added `ctx` argument. Without that line, the helper still cannot inspect the caller’s auth state or package visibility and remains blind to whether private package metadata should be filtered. The rest of the patch is just signature propagation; the developer added the extra parameter so downstream code could perform permission-aware response generation. If that line were removed, the bug would still be exploitable.

## Hardening Checklist

- Pass request context into all helper functions that generate authorization-sensitive API responses.
- Enforce package visibility checks before serializing metadata, using explicit authorization logic rather than implicit path-based assumptions.
- Treat package metadata endpoints as sensitive resources and return `http.StatusForbidden` for unauthorized access.
- Avoid constructing API responses from owner/package path values alone; include the caller’s `ctx` or auth token state in permission decisions.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2026-27771

CVE CVE-2026-27771

PRODUCT gitea

AFFECTED ≤ v1.26.1

FIXED IN v1.26.2

STATUS Generated

Security writeup · CVE-2026-27771

Source files · 23

models/activities/action.go Linked

models/organization/org_list.go Linked

modules/actions/jobparser/jobparser.go Linked

modules/git/gitcmd/command.go Linked

modules/git/pipeline/lfs_nogogit.go Linked

modules/util/sanitize.go Linked

modules/util/sanitize_test.go Linked

routers/api/packages/composer/composer.go Linked

routers/api/v1/repo/action.go Linked

routers/api/v1/user/watch.go Linked

routers/common/compare.go Linked

routers/web/auth/oauth.go Linked

routers/web/repo/blame.go Linked

routers/web/repo/githttp.go Linked

services/actions/notifier_helper.go Linked

services/actions/workflow.go Linked

services/auth/basic.go Linked

services/context/permission.go Linked

services/convert/wiki.go Linked

services/mailer/token/token.go Linked

services/repository/push.go Linked

tests/integration/api_issue_templates_test.go Linked

tests/integration/api_user_public_only_test.go Linked

↗ NVD