Gitea has insufficient permission checks for Composer package source links

CVE Description

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

Summary

A critical vulnerability has been discovered in Gitea. It was already reported via ([email protected]) from ([email protected]), and submitted an encrypted report.