Is CVE-2026-66849 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-66849?

CVE-2026-66849 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-66849

Description

Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects user-owned package registries and exposes package contents across the intended authorization boundary.