CVE-2026-27771 affects Gitea Open Source Git Server versions up to 1.26.1 by lacking adequate authorization checks for Composer package source links. This allows unauthorized users to access private or internal package source information that should be restricted. The vulnerability is remotely exploitable without authentication and does not require user interaction. The CVSS 3.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

The vulnerability can lead to unauthorized disclosure of private or internal package source information in Gitea repositories. This compromises confidentiality but does not affect integrity or availability. Attackers can remotely access sensitive package source links without authentication, potentially exposing proprietary or sensitive development resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Gitea instances and limit exposure of Composer package source links to trusted users only. Monitor vendor communications for updates on patches or official mitigations.