Orta CVSS 4.3
CVE-2026-66849: CVE-2026-66849: güvenlik açığı
Açıklama (NVD)
Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects user-owned package registries and exposes package contents across the intended authorization boundary.
Özet bilgiler
- CVSS v3.1
- 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - EPSS
- %0,37 (yüzdelik 31)
- CWE
- CWE-284
- Yama
- Yok / bilinmiyor