References https://horizon3.ai/attack-research/vulnerabilities/cve-2026-27771/ https://thehackernews.com/2026/05/gitea-vulnerability-exposes-private.html https://orca.security/resources/blog/gitea-container-registry-vulnerability/ https://www.gm7.org/archives/107862 https://www.securityweek.com/gitea-vulnerability-exposed-30000-deployments-to-attacks/ https://www.fwidc.com/news/44_85765.html https://blog.gitea.com/release-of-1.26.2/
Related VulnerabilitiesGitea /api/v1/repos/diffpatch 代码执行漏洞(CVE-2026-60004)Gitea Org-mode 文件读取漏洞(CVE-2026-59774)PoCCVE-2026-20896: Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication BypassPoCCVE-2026-59774: Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File ReadPoCCVE-2026-60004: Gitea <= 1.27.0 - Pre-Auth Remote Code ExecutionPoCCVE-2026-27771: Gitea Container Registry - Unauthorized Private Image AccessGitea /v2/_catalog 未授权访问漏洞(CVE-2026-27771)PoCgitea-userenum: Gitea - User EnumerationGitea用户信息泄露PoCCVE-2021-45328: Gitea < 1.4.3 - Open RedirectPoCgitea-open-redirect-bypass: Gitea < 1.21.0 - Open RedirectPoCglitchtip-public-signup: Gitea Public Registration EnabledPoCgitea-public-repo-exposure: Gitea Public Repository - Exposure