code.gitea.io/gitea
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Go
- Vulnerability status
- affected by 3 advisory(ies)
Advisories (193)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-25gq-j9jx-43pg Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | < 1.27.0 | Undetermined |
| GHSA-263q-5cv3-xq9g Gitea allows attackers to add attachments with forbidden file extensions | * | Affected |
| GHSA-2fcr-jfvc-vgg2 Gitea: Two SSRF findings | < 1.27.0 | Undetermined |
| GHSA-2r5c-gw76-rh3w Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter | < 1.26.3 | Undetermined |
| GHSA-2wm4-vwp6-v7xc Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata | < 1.27.0 | Undetermined |
| GHSA-3393-r4p5-vhqh Gitea Allows 1FA Even for 2FA-Enrolled Accounts | < 1.8.0 | Undetermined |
| GHSA-37w2-86g3-h4qh Gitea organization permission APIs expose hidden membership and private organization data | < 1.25.5 | Undetermined |
| GHSA-3fwp-p5rj-2pxf Gitea: Missing repository-unit authorization on issue-template API endpoints | < 1.26.2 | Undetermined |
| GHSA-3h6c-c475-jm7v Arbitrary Code Execution in Gitea | 1.1.0 – < 1.12.6 | Undetermined |
| GHSA-3m6q-h5gj-7mrw Gitea has insecure default SSH settings | < 1.25.0 | Undetermined |
| GHSA-3pww-vcvm-3gmj Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data | < 1.26.3 | Undetermined |
| GHSA-3r5c-2xxx-h872 Gitea: Webhook Authorization Header Returned in Plaintext via API | < 1.27.0 | Undetermined |
| GHSA-44qc-pgvp-wx7v Gitea: Notification API leaks private issue metadata after access revocation | < 1.26.4 | Undetermined |
| GHSA-47rq-xp99-92mx Gitea pull request branch permission checks allow unauthorized updates and rebases | < 1.25.5 | Undetermined |
| GHSA-4c8f-3m6h-m56r Gitea primary email ownership bypass allows cross-user email changes | < 1.25.5 | Undetermined |
| GHSA-4h4p-553m-46qh Gitea Cross-site Scripting Vulnerability | < 1.22.1 | Undetermined |
| GHSA-4rqq-rxvc-v2rc Gitea Open Redirect | < 1.16.5 | Undetermined |
| GHSA-4xjf-493q-98p3 Gitea SSH Key Parser Denial of Service | < 1.27.0 | Undetermined |
| GHSA-5rh7-6gfj-mc87 Gitea XSS Vulnerability | < 1.7.1 | Undetermined |
| GHSA-5v69-g2m3-3hq3 Gitea OAuth2 authorization codes can be reused after expiry | < 1.25.5 | Undetermined |
| GHSA-649p-mmhf-85c7 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | < 1.26.3 | Undetermined |
| GHSA-683j-3ff6-hh2x Gitea: Privilege Escalation via Access Token Scope Escalation in API | < 1.27.0 | Undetermined |
| GHSA-6c6r-5xr4-cr5m Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content | < 1.27.0 | Undetermined |
| GHSA-6cqf-375w-639g Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) | < 1.27.0 | Undetermined |
| GHSA-6hm7-3pwj-22rm Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload | < 1.27.0 | Undetermined |
| GHSA-777r-4v59-6486 Gitea: Permanent Fork PR Workflow Approval Gate Bypass | < 1.26.3 | Undetermined |
| GHSA-7jvx-g65v-r899 Gitea release asset dumps permit path traversal through crafted names | < 1.25.5 | Undetermined |
| GHSA-7p4h-3gxq-x3h3 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | < 1.27.0 | Undetermined |
| GHSA-7wvc-rvp7-w99x Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories | 1.23.0 – < 1.26.3 | Undetermined |
| GHSA-7xq4-mwcp-q8fx Gitea: anonymous user can visit private user's project | < 1.21.2 | Undetermined |
| GHSA-82f7-87hm-852x Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration | < 1.27.0 | Undetermined |
| GHSA-8629-vc8r-5p58 Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw | < 1.26.2 | Undetermined |
| GHSA-898p-hh3p-hf9r Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text | < 1.22.2 | Undetermined |
| GHSA-8fwc-qjw5-rvgp Gitea may send release notification emails for private repositories to users whose access has been revoked | < 1.25.4 | Undetermined |
| GHSA-8j3v-68w3-3848 Gitea erroneous repo clones | < 1.17.2 | Undetermined |
| GHSA-8p9h-49rc-qgxj Gitea: Repository Visibility Manipulation via Git Push Options | < 1.27.0 | Undetermined |
| GHSA-8qw8-rq86-9pc2 Gitea has insufficient permission checks for Composer package source links | < 1.26.2 | Undetermined |
| GHSA-922f-hfwp-p56f Gitea repository creation accepts insufficiently validated fields | < 1.25.5 | Undetermined |
| GHSA-94v3-77j7-vm48 Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override | < 1.27.0 | Undetermined |
| GHSA-9cpj-qc93-vw8v Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer | 1.25.0 – < 1.26.0 | Undetermined |
| GHSA-9mq6-mqjj-c2c5 Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads | < 1.27.0 | Undetermined |
| GHSA-9r5x-wg6m-x2rc Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication | < 1.26.2 | Undetermined |
| GHSA-cc8w-r4qh-3v65 Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens | < 1.26.2 | Undetermined |
| GHSA-cf6v-9j57-v6r6 code.gitea.io/gitea Open Redirect vulnerability | < 1.19.4 | Undetermined |
| GHSA-cm54-pfmc-xrwx Gitea mishandles authorization for deletion of releases | < 1.25.2 | Undetermined |
| GHSA-cp3q-vrj2-ghhh Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents | < 1.27.0 | Undetermined |
| GHSA-cr4g-f395-h25h Gitea: Token scope bypass on web archive download endpoint | < 1.26.2 | Undetermined |
| GHSA-f75j-4cw6-rmx4 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` | < 1.26.3 | Undetermined |
| GHSA-f85h-c7m6-cfpm Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries | < 1.22.2 | Undetermined |
| GHSA-fg3x-rwq9-74cw Gogs and Gitea SSRF Vulnerability | < 1.16.0-rc1 | Undetermined |
| GHSA-fhq3-p242-2qpf Gitea exposes tracked time entries without repository authorization | < 1.25.5 | Undetermined |
| GHSA-fhv8-m4j4-cww2 Gitea allowed assignment of private issues | < 1.16.9 | Undetermined |
| GHSA-fhx7-m96w-mv29 Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration | < 1.26.0 | Undetermined |
| GHSA-fq2p-5p22-8g6j Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | < 1.27.0 | Undetermined |
| GHSA-frpw-3h2q-4jj6 Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs | < 1.27.0 | Undetermined |
| GHSA-fw57-jgch-pgf3 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | < 1.27.0 | Undetermined |
| GHSA-g7p7-x6w7-w6qg Arbitrary file deletion in gitea | < 1.16.4 | Undetermined |
| GHSA-g95p-88p4-76cm Cross-site Scripting in Gitea | < 1.13.4 | Undetermined |
| GHSA-g9g6-qhrc-p3qc Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts | < 1.26.4 | Undetermined |
| GHSA-gx3v-q759-g323 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface | 1.5.0 – < 1.26.3 | Undetermined |
| GHSA-h2x6-g7q6-344v Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass | < 1.27.0 | Undetermined |
| GHSA-h3q4-vmw4-cpr5 Path Traversal in Gitea | < 1.13.6 | Undetermined |
| GHSA-h697-89cp-24q8 Gitea template repository generation follows unsafe filesystem paths | < 1.25.5 | Undetermined |
| GHSA-h9c5-x7g8-4q7f Gitea git grep searches allow server resource exhaustion | < 1.25.5 | Undetermined |
| GHSA-hf6f-jq25-8gq9 Gitea Remote Code Execution (RCE) | < 1.5.2 | Undetermined |
| GHSA-hfmf-q69j-6m5p Reuse of one time passwords allowed in Gitea | < 1.5.0 | Undetermined |
| GHSA-hg5r-vq93-9fv6 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write | 1.22.0 – < 1.26.2 | Undetermined |
| GHSA-hgr3-x44x-33hx Gitea has improper access control for uploaded attachments | < 1.25.4 | Undetermined |
| GHSA-hq57-c72x-4774 Gitea vulnerable to Cross-site Scripting | < 1.20.1 | Undetermined |
| GHSA-hqx2-j33x-9fc4 Gitea XSS Vulnerability in Repository Description | 1.7.2 – < 1.7.4 | Undetermined |
| GHSA-j2w3-9c3r-g83q Gitea: Private Repository Metadata Remains Accessible After Access Revocation | < 1.27.0 | Undetermined |
| GHSA-j99q-rwp6-498g Gitea Arbitrary File Delete Vulnerability | < 1.6.3 | Undetermined |
| GHSA-jhx5-4vr4-f327 Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order | < 1.21.8 | Undetermined |
| GHSA-jr9c-h74f-2v28 Gitea Missing Authorization vulnerability | < 1.16.4 | Undetermined |
| GHSA-m5ch-ppfx-xv3v Gitea OAuth2 PKCE S256 verifier bypass | < 1.25.5 | Undetermined |
| GHSA-m932-crvm-gcp5 Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | < 1.27.0 | Undetermined |
| GHSA-mg4f-x9v4-6h2p Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | < 1.27.0 | Undetermined |
| GHSA-mm7c-rhg6-qr4r Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo | < 1.26.2 | Undetermined |
| GHSA-p4mj-98mv-xq26 Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint | < 1.27.0 | Undetermined |
| GHSA-p5f9-c9j9-g8qx Shell command injection in gitea | < 1.16.7 | Undetermined |
| GHSA-pc73-rj2c-wvf9 Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists | < 1.25.2 | Undetermined |
| GHSA-pg38-r834-g45j Improper Privilege Management in Gitea | < 1.6.0 | Undetermined |
| GHSA-pgqf-926r-548m Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | < 1.27.0 | Undetermined |
| GHSA-ph3w-2843-72mx Stored Cross-site Scripting in gitea | < 1.16.9 | Undetermined |
| GHSA-q423-49rw-g9mh Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private | < 1.27.0 | Undetermined |
| GHSA-q9pg-jj6x-j9p6 Gitea: draft release attachment disclosure via missing web authorization | < 1.27.0 | Undetermined |
| GHSA-qf2f-qh6p-7v89 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` | < 1.27.0 | Undetermined |
| GHSA-qm72-8prh-g92x Gitea tracked-time deletion is not scoped to the requested issue | < 1.25.5 | Undetermined |
| GHSA-rc56-rj3f-xggf Gitea LFS mirror operations bypass migration HTTP transport protections | < 1.25.5 | Undetermined |
| GHSA-rgv6-xp99-6mgj Gitea Remember-Me Token Theft Not Invalidating Attacker Session | < 1.27.0 | Undetermined |
| GHSA-rh79-75qm-gwjr Gitea LFS Deploy-Key Privilege Escalation | < 1.27.0 | Undetermined |
| GHSA-rjvx-x5h2-6px5 Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions | < 1.26.0 | Undetermined |
| GHSA-rqhx-647v-wx32 Gitea: SSRF via HTTP Redirect in Repository Migration | < 1.26.4 | Undetermined |
| GHSA-rrcw-5rjv-vj26 Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. | < 1.22.5 | Undetermined |
| GHSA-v73x-hx65-6pf4 Gitea: Unauthorized Access to Labels of Private Organizations | < 1.26.3 | Undetermined |
| GHSA-v8f2-2ghq-9whv Gitea forwarded-proto validation allows canonical URL spoofing | < 1.25.5 | Undetermined |
| GHSA-v96j-25gv-g2w9 Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service | < 1.26.4 | Undetermined |
| GHSA-vhq7-fwwh-7hjf Gitea pre-receive hook scanner errors allow branch-protection bypass | < 1.26.0 | Undetermined |
| GHSA-vrhc-jjfc-m3m3 Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | < 1.27.0 | Undetermined |
| GHSA-vxv2-8j6r-pcpg Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) | < 1.27.0 | Undetermined |
| GHSA-w5pg-649r-p6gg Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag | < 1.27.0 | Undetermined |
| GHSA-wrf9-r3h7-7x5v Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private | < 1.26.3 | Undetermined |
| GHSA-wrr5-99h5-gq57 Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | 1.22.3 – < 1.26.2 | Undetermined |
| GHSA-wwqq-x6w4-frm2 Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint | < 1.27.0 | Undetermined |
| GHSA-x77v-q46j-393g Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim | < 1.27.0 | Undetermined |
| GHSA-x92v-f5gc-r34v Gitea draft releases and attachments are exposed without write permission | < 1.25.5 | Undetermined |
| GHSA-xfq3-qj7j-4565 Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources | < 1.22.3 | Undetermined |
| GHSA-xmj7-xj85-hfc3 Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL | < 1.27.0 | Undetermined |
| GHSA-xxjv-752h-3vp2 Gitea: Public-only repository tokens can update private PR head branches | < 1.27.0 | Undetermined |
| GO-2022-0310 Capture-replay in Gitea in code.gitea.io/gitea | < 1.11.2 | Undetermined |
| GO-2022-0315 Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea | < 1.5.0 | Undetermined |
| GO-2022-0353 Path Traversal in Gitea in code.gitea.io/gitea | < 1.13.6 | Undetermined |
| GO-2022-0442 Arbitrary file deletion in gitea in code.gitea.io/gitea | < 1.16.4 | Undetermined |
| GO-2022-0450 Shell command injection in gitea in code.gitea.io/gitea | < 1.16.7 | Undetermined |
| GO-2022-0609 Gitea Missing Authorization vulnerability in code.gitea.io/gitea | < 1.16.4 | Undetermined |
| GO-2022-0612 Stored Cross-site Scripting in gitea in code.gitea.io/gitea | < 1.16.9 | Undetermined |
| GO-2022-0830 Denial of Service in Gitea in code.gitea.io/gitea | < 1.12.0 | Undetermined |
| GO-2022-0832 Cross-site Scripting in Gitea in code.gitea.io/gitea | < 1.13.4 | Undetermined |
| GO-2022-0844 Gitea Remote Code Execution (RCE) in code.gitea.io/gitea | < 1.5.2 | Undetermined |
| GO-2022-0982 Improper Privilege Management in Gitea in code.gitea.io/gitea | < 1.6.0 | Undetermined |
| GO-2022-1065 Gitea vulnerable to Argument Injection in code.gitea.io/gitea | < 1.17.3 | Undetermined |
| GO-2023-1894 code.gitea.io/gitea Open Redirect vulnerability | < 1.19.4 | Undetermined |
| GO-2023-1922 Gitea XSS Vulnerability in code.gitea.io/gitea | < 1.7.1 | Undetermined |
| GO-2023-1971 Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea | < 1.16.0-rc1 | Undetermined |
| GO-2023-1999 Gitea erroneous repo clones in code.gitea.io/gitea | < 1.17.2 | Undetermined |
| GO-2024-2752 Gitea Open Redirect in code.gitea.io/gitea | < 1.16.5 | Undetermined |
| GO-2024-2757 Buffer Overflow in gitea in code.gitea.io/gitea | 1.9.0 – < 1.13.2 | Undetermined |
| GO-2024-2769 Gitea allowed assignment of private issues in code.gitea.io/gitea | < 1.16.9 | Undetermined |
| GO-2024-3056 Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea | < 1.22.1 | Undetermined |
| GO-2025-4258 Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea | < 1.25.2 | Undetermined |
| GO-2025-4261 Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea | * | Affected |
| GO-2025-4262 Gitea: anonymous user can visit private user's project in code.gitea.io/gitea | < 1.21.2 | Undetermined |
| GO-2025-4263 Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea | < 1.22.2 | Undetermined |
| GO-2025-4264 Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea | < 1.22.2 | Undetermined |
| GO-2025-4265 Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea | < 1.20.1 | Undetermined |
| GO-2025-4266 Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea | < 1.21.8 | Undetermined |
| GO-2025-4267 Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea | < 1.22.5 | Undetermined |
| GO-2025-4268 Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea | < 1.22.3 | Undetermined |
| GO-2026-4274 Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea | < 1.25.2 | Undetermined |
| GO-2026-4362 Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea | < 1.25.4 | Undetermined |
| GO-2026-4363 Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea | < 1.25.4 | Undetermined |
| GO-2026-4364 Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea | < 1.25.4 | Undetermined |
| GO-2026-4365 Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea | < 1.25.4 | Undetermined |
| GO-2026-4366 Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea | < 1.25.4 | Undetermined |
| GO-2026-4367 Gitea has improper access control for uploaded attachments in code.gitea.io/gitea | < 1.25.4 | Undetermined |
| GO-2026-4368 Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea | < 1.25.4 | Undetermined |
| GO-2026-4369 Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea | < 1.25.4 | Undetermined |
| GO-2026-4370 Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea | < 1.25.4 | Undetermined |
| GO-2026-5081 Gitea: Missing repository-unit authorization on issue-template API endpoints in code.gitea.io/gitea | < 1.26.2 | Undetermined |
| GO-2026-5091 Gitea has insecure default SSH settings in code.gitea.io/gitea | < 1.25.0 | Undetermined |
| GO-2026-5243 Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw in code.gitea.io/gitea | < 1.26.2 | Undetermined |
| GO-2026-5286 Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer in code.gitea.io/gitea | 1.25.0 – < 1.26.0 | Undetermined |
| GO-2026-5299 Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication in code.gitea.io/gitea | < 1.26.2 | Undetermined |
| GO-2026-5321 Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens in code.gitea.io/gitea | < 1.26.2 | Undetermined |
| GO-2026-5334 Gitea: Token scope bypass on web archive download endpoint in code.gitea.io/gitea | < 1.26.2 | Undetermined |
| GO-2026-5365 Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration in code.gitea.io/gitea | < 1.26.0 | Undetermined |
| GO-2026-5448 Gitea: Open Redirect via redirect_to in code.gitea.io/gitea | < 1.26.0 | Undetermined |
| GO-2026-5510 Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo in code.gitea.io/gitea | < 1.26.2 | Undetermined |
| GO-2026-5721 Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes in code.gitea.io/gitea | 1.22.3 – < 1.26.2 | Undetermined |
| GO-2026-6017 Gitea has insufficient permission checks for Composer package source links in code.gitea.io/gitea | < 1.26.2 | Undetermined |
| GO-2026-6029 Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea | < 1.26.3 | Undetermined |
| GO-2026-6030 Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea | < 1.26.3 | Undetermined |
| GO-2026-6031 Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea | < 1.26.3 | Undetermined |
| GO-2026-6041 Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea | < 1.26.4 | Undetermined |
| GO-2026-6043 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea | < 1.26.3 | Undetermined |
| GO-2026-6044 Gitea: Permanent Fork PR Workflow Approval Gate Bypass in code.gitea.io/gitea | < 1.26.3 | Undetermined |
| GO-2026-6046 Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories in code.gitea.io/gitea | 1.23.0 – < 1.26.3 | Undetermined |
| GO-2026-6051 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` in code.gitea.io/gitea | < 1.26.3 | Undetermined |
| GO-2026-6056 Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts in code.gitea.io/gitea | < 1.26.4 | Undetermined |
| GO-2026-6057 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface in code.gitea.io/gitea | 1.5.0 – < 1.26.3 | Undetermined |
| GO-2026-6060 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea | 1.22.0 – < 1.26.2 | Undetermined |
| GO-2026-6074 Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea | < 1.26.0 | Undetermined |
| GO-2026-6075 Gitea: SSRF via HTTP Redirect in Repository Migration in code.gitea.io/gitea | < 1.26.4 | Undetermined |
| GO-2026-6076 Gitea: Unauthorized Access to Labels of Private Organizations in code.gitea.io/gitea | < 1.26.3 | Undetermined |
| GO-2026-6077 Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in code.gitea.io/gitea | < 1.26.4 | Undetermined |
| GO-2026-6080 Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag in go-gitea/gitea | * | Affected |
| GO-2026-6081 Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private in code.gitea.io/gitea | < 1.26.3 | Undetermined |
| GO-2026-6333 Gitea organization permission APIs expose hidden membership and private organization data in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6334 Gitea pull request branch permission checks allow unauthorized updates and rebases in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6335 Gitea primary email ownership bypass allows cross-user email changes in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6336 Gitea OAuth2 authorization codes can be reused after expiry in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6337 Gitea release asset dumps permit path traversal through crafted names in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6338 Gitea repository creation accepts insufficiently validated fields in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6339 Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6340 Gitea template repository generation follows unsafe filesystem paths in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6341 Gitea git grep searches allow server resource exhaustion in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6342 Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6343 Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6344 Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6345 Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6346 Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea | < 1.26.0 | Undetermined |
| GO-2026-6347 Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea | < 1.25.5 | Undetermined |
| GO-2026-6433 Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev | ≥ 1.17.0 | Undetermined |
Sources
| Source | Licence |
|---|