Gitea - Authentication Bypass (CVE-2026-27771)

CVE-2026-27771 is a newly identified vulnerability, but specific details regarding its nature, affected components, and potential impact have not yet been disclosed. As information becomes available, organizations should monitor official advisories to assess risk and determine appropriate mitigation steps.

CrowdSec has been tracking this vulnerability and its exploits since 24th of June 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-27771 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2026-27771. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit the /v2/token endpoint to obtain unauthorized tokens and then access /v2/_catalog to enumerate and pull private container images from vulnerable Gitea instances. This allows unauthenticated users to bypass access controls and exfiltrate sensitive data from private registries.