CVE-2026-66849 Gitea CVE debrief

Who should care

Gitea administrators and users with restricted packages should assess their exposure and take remediation steps to prevent unauthorized access. This involves reviewing package registry access controls, updating Gitea to the latest version, and ensuring proper configuration of restricted users' visibility. Additionally, defenders should prioritize verifying and remediating this vulnerability in their Gitea instances, especially those with restricted users

Why it matters

Defenders should prioritize verifying and remediating this vulnerability in their Gitea instances, especially those with restricted users and package registries, to prevent unauthorized access to package contents.

• Potential unauthorized access to sensitive package contents
• Bypass of intended visibility policy for restricted users
• Possible enumeration and download of packages by restricted users

Technical summary

The vulnerability in Gitea's package registry allows authenticated users to access packages owned by users with limited visibility. This issue affects user-owned package registries and exposes package contents across the intended authorization boundary. The vulnerability arises from insufficient access controls, enabling restricted users to enumerate and download packages they should not have access to. Technical details indicate that the issue is related to improper access control in the package registry, allowing unauthorized access to package contents.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their Gitea instances, especially those with restricted users and package registries.

Recommended defensive actions

• Verify Gitea instance configuration to ensure restricted users' package visibility is properly set and access controls are enforced.
• Update Gitea to version 1.27.3 or later to address the vulnerability.
• Review package registry access controls and restrict access as needed to prevent unauthorized access.
• Conduct a thorough review of package contents and user access to identify potential exposure.
• Implement compensating controls, such
• technicalSummary
• whoShouldCare

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on affected versions and remediation steps is limited. The issue is confirmed to affect user-owned package registries, and defenders should verify their Gitea instances for exposure. Evidence from the CVE record and source item suggests that the vulnerability is related to insufficient access controls in Gitea's package registry. However, specific details on the root cause and affected versions are not provided. Defenders should review the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.