CVE-2026-66849: Gitea restricted-user package visibility bypass
Published Oct 14, 2026
·Updated
Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects user-owned package registries and exposes package contents across the intended authorization boundary.
Affected Software
1 affected component
Gitea Gitea
Event History
Oct 14, 2026
CVE Published
via MITRE·02:35 PM
Data Sourced
via MITRE·02:35 PM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue, and what access do they need?
An attacker must be an authenticated Gitea user whose account is restricted. Such a user can enumerate and download packages owned by Limited-visibility users.
2
What package registries are affected?
The issue affects user-owned package registries. It exposes package contents across the intended authorization boundary for packages owned by Limited-visibility users.