Gitea Container Registry Authorization Bypass (CVE-2026-27771) — Unauthenticated Pull of Private Container Images Across 31,000+ Self-Hosted Instances — Threadlinqs Intelligence
As of 2026-05-30, Gitea Container Registry Authorization Bypass (CVE-2026-27771) — Unauthenticated Pull of Private Container Images Across 31,000+ Self-Hosted Instances is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-0602 · Severity: HIGH · Status: MONITORING · Category: VULNERABILITY
CVE-2026-27771 is a missing-authorization flaw in Gitea's package registry (also affecting the Forgejo fork) that allowed any unauthenticated remote user to pull container images and access package
Overview
CVE-2026-27771 is an improper-authorization (CWE-285 / CWE-862) vulnerability in the Gitea package registry subsystem that affects all Gitea releases prior to 1.26.2 and the upstream-derived Forgejo distribution. The flaw allows an unauthenticated remote attacker — with no Gitea account, API token, or registry credentials — to retrieve container images, Composer package source URLs, and other package metadata from repositories that operators explicitly marked private or internal. Because Gitea is a widely deployed self-hosted DevOps platform (a Gogs-derived alternative to GitHub Enterprise and GitLab Self-Managed), the issue exposes source code artifacts, build outputs, configuration baked into images, and any secrets accidentally embedded in private container layers (cloud credentials, API keys, internal CA material, signing keys, registry tokens).
Technical Root Cause
The root cause sits in the shared package-permission code path that Gitea's container registry, Composer registry, and other package-type handlers all build on top of. The patch commit (PR #37610, ''fix(packages): Add label for private and internal package and fix composor package source permission check'', credited to NoScope and implemented by Gitea maintainer @lunny) modifies routers/api/packages/composer/api.go so that createPackageMetadataResponse now invokes GetDoerRepoPermission against the package''s owning repository before populating Composer source URL fields in the response payload. Code reviewers on the PR explicitly flagged that the helper must use HasAnyUnitAccessOrPublicAccess rather than HasAnyUnitAccess to correctly handle repositories with public-unit-only configurations (where the repo is private but selected units are exposed). The PR also adds visibility badges across package list, detail, settings, and cleanup-preview templates so that operators can no longer be deceived by a UI that displays packages without indicating their private/internal scope.
The practical effect on the OCI surface is that an unauthenticated GET against /v2/{owner}/{image}/manifests/{tag} or /v2/{owner}/{image}/blobs/sha256:{digest} returned 200 for images attached to private repositories rather than the expected 401 Unauthorized or 404 Not Found. Noscope explicitly withheld exact endpoint paths and exploitation payloads from their public writeup; the technical attribution above is derived from the only commit linked to CVE-2026-27771 in the Gitea 1.26.2 changelog. Although Noscope frames the impact in container-registry terms, the fix landing in the Composer/packages permission code indicates that the missing access check is in shared package metadata logic that the container registry inherits — meaning a single authorization fix closes both surfaces.
Exploit Chain
There is no privilege escalation or persistence sequence required: the entire chain collapses into a single unauthenticated HTTP GET. (1) Reconnaissance — Internet-wide scanning via Shodan, Censys, or simple HTTP probes against Gitea''s default port (3000) or HTTPS variants on 80/443 enumerates candidate instances; the Gitea UI banner and /api/v1/version endpoint readily fingerprint Gitea and Forgejo. (2) Target enumeration — The attacker queries /api/v1/repos/search and /api/v1/users/search to identify owners and repositories, then probes /api/packages/{owner}/{type}/{name} to enumerate package names attached to private repositories. (3) Manifest pull — An OCI client (docker pull, skopeo copy, oras pull, or raw curl against /v2/) requests the manifest for the target image; under the vulnerable code path the registry returns the manifest without an authorization check. (4) Blob retrieval — Each layer digest from the manifest is fetched via /v2/{owner}/{image}/blobs/sha256:{digest}; the attacker can reconstruct the entire image, including filesystem contents and environment-variable-baked secrets. (5) Secondary impact — Extracted images frequently contain build-time credentials, .env files
Weaknesses (CWE)
CWE-285, CWE-862, CWE-200
Target sectors: healthcare, aerospace, industrial-manufacturing, retail, isp-telecom, software-development, social-media, saas-edtech, enterprise-cms
Target regions: China, United States, Germany, France, United Kingdom, Asia, Europe, North America
Timeline
- Vulnerable package permission code path is introduced in Gitea (~four-year window prior to discovery per Noscope research).
- Security firm Noscope identifies CVE-2026-27771 during an audit of the Gitea package registry.
- Noscope validates the bypass against a 100-host Shodan sample, observing ~93 percent of probed instances responding consistent with the issue; extrapolates 31,750 affected deployments.
- Noscope reports the vulnerability to the Gitea security team and a CVE identifier (CVE-2026-27771) is reserved.
- Gitea 1.26.2 is released at 18:51 UTC containing PR #37610 (''fix(packages): Add label for private and internal package and fix composor package source permission check''), crediting NoScope.
- Noscope publishes its research blog and The Hacker News carries the disclosure; exposure data (30+ countries, 31,750 instances, two-thirds in CN/US/DE) becomes public.
- Threadlinqs Intelligence opens TL-2026-0602 for full analysis, detection authoring, and exposure correlation against BeaconBeagle and customer asset inventories.
- As of 2026-05-29, CVE-2026-27771 (Gitea/Forgejo container registry auth bypass) is patched in Gitea 1.26.2 with no confirmed in-the-wild exploitation, public PoC, or CISA KEV listing. It stays a live concern: ~31,750 exposed instances, trivial single-GET exploitation, public fix commit, and a still-pending Forgejo backport invite opportunistic scanning.
Detections & IOCs
As of 2026-08-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-27771, T1595, T1595.002, T1592, T1596, T1596.005, T1190, T1078, T1552, T1552.001, T1552.007
