Gitea Gitea Open Source Git Server
97 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-24791 | 1.22.3 – 1.26.1 | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | HIGH 8.1 | 0.4 % | ||
| CVE-2026-24059 | < 1.25.5 | Gitea runner registration-token GET endpoint performs a write under a read-only token scope | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-59765 | ≤ 1.26.4 | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata | HIGH 7.5 | 0.4 % | ||
| CVE-2026-59763 | ≤ 1.26.4 | Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-58511 | ≤ 1.26.4 | Webhook Authorization Header Returned in Plaintext via API | LOW 2.7 | 0.4 % | ||
| CVE-2026-58510 | ≤ 1.26.4 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-58508 | ≤ 1.26.4 | Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-58507 | ≤ 1.26.4 | Private Repository Existence Disclosure via go-get Meta Endpoint | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-58445 | ≤ 1.26.4 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | LOW 2.7 | 0.4 % | ||
| CVE-2026-58444 | < 1.27.0 | Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-58443 | ≤ 1.26.4 | Public-only repository tokens can update private PR head branches | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-58442 | ≤ 1.26.4 | Repository migration SSRF via multi-answer DNS allow-list bypass | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-58441 | ≤ 1.26.4 | SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-58440 | ≤ 1.26.4 | Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo conten… | MEDIUM 6.8 | 0.5 % | ||
| CVE-2026-58439 | ≤ 1.26.4 | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag | HIGH 8.1 | 0.5 % | ||
| CVE-2026-58438 | ≤ 1.26.4 | Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access | HIGH 7.5 | 0.5 % | ||
| CVE-2026-58437 | ≤ 1.26.4 | Repository Visibility Manipulation via Git Push Options | HIGH 7.1 | 0.3 % | ||
| CVE-2026-58436 | ≤ 1.26.4 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | HIGH 7.5 | 0.6 % | ||
| CVE-2026-58435 | ≤ 1.26.4 | Gitea LFS Deploy-Key Privilege Escalation | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-58434 | 1.26.2 | Private Repository Metadata Remains Accessible After Access Revocation | HIGH 7.5 | 0.5 % | ||
| CVE-2026-58433 | ≤ 1.26.4 | Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-58432 | ≤ 1.26.4 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and … | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-58431 | ≤ 1.26.4 | Public-only API token restriction is not enforced on team API routes | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-58429 | ≤ 1.26.4 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | MEDIUM 4.9 | 0.5 % | ||
| CVE-2026-58428 | ≤ 1.26.4 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-58427 | ≤ 1.26.4 | Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 | HIGH 7.5 | 0.5 % | ||
| CVE-2026-58425 | ≤ 1.26.4 | OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-58420 | ≤ 1.26.4 | Local File Inclusion via file:// URI in Migration Restore | MEDIUM 4.4 | 0.5 % | ||
| CVE-2026-58417 | ≤ 1.26.4 | REST API exposes organization membership of private organizations to public | HIGH 7.5 | 0.5 % | ||
| CVE-2026-58416 | ≤ 1.26.4 | Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) | HIGH 7.1 | 0.3 % | ||
| CVE-2026-58314 | ≤ 1.26.4 | Two SSRF findings in Gitea 1.26.2 | HIGH 7.7 | 0.4 % | ||
| CVE-2026-57897 | ≤ 1.26.4 | Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-57894 | ≤ 1.26.4 | Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration | HIGH 8.5 | 0.4 % | ||
| CVE-2026-57886 | ≤ 1.26.4 | Cross-repository issue/comment attachment re-linking can expose private attachment content | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-56755 | ≤ 1.26.4 | Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-56750 | ≤ 1.26.4 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-56657 | ≤ 1.26.4 | Gitea SSH Key Parser Denial of Service | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-56654 | ≤ 1.26.4 | Privilege Escalation via Access Token Scope Escalation in API | CRITICAL 9.8 | 0.8 % | ||
| CVE-2026-56443 | ≤ 1.26.4 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | CRITICAL 9.6 | 0.5 % | ||
| CVE-2026-55987 | ≤ 1.26.4 | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | HIGH 8.1 | 0.4 % | ||
| CVE-2026-55986 | ≤ 1.26.4 | Email Management API Bypasses ManageCredentials Feature Restrictions | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-55984 | ≤ 1.26.4 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | LOW 2.7 | 0.5 % | ||
| CVE-2026-55982 | 1.26.2 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-54481 | ≤ 1.26.4 | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) | HIGH 7.5 | 0.3 % | ||
| CVE-2026-50105 | ≤ 1.26.4 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-42931 | ≤ 1.24 | Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-23603 | ≤ 1.26.4 | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim | LOW 3.1 | 0.3 % | ||
| CVE-2026-58426 | 1.22.0 – 1.26.1 | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write | CRITICAL 9.6 | 0.2 % | ||
| CVE-2026-58424 | ≤ 1.26.2 | Permanent Fork PR Workflow Approval Gate Bypass | HIGH 8.9 | 0.3 % | ||
| CVE-2026-58423 | 1.23.0 – 1.26.2 | LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories | HIGH 7.7 | 0.4 % | ||
| CVE-2026-58422 | ≤ 1.26.1 | Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-58421 | < 1.26.2 | Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service | HIGH 7.5 | 0.4 % | ||
| CVE-2026-58419 | 1.26.2 | Notification API leaks private issue metadata after access revocation | HIGH 7.5 | 0.4 % | ||
| CVE-2026-58418 | ≤ 1.25.4 | SSRF via HTTP Redirect in Repository Migration | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-28744 | ≤ 1.26.1 | Gitea Git smart HTTP bypasses repository token scopes for bearer tokens | HIGH 8.1 | 0.4 % | ||
| CVE-2026-28740 | ≤ 1.26.2 | Gitea LFS object reuse bypasses Code-unit authorization | HIGH 7.1 | 0.3 % | ||
| CVE-2026-28737 | 1.25.0 – < 1.26.0 | Gitea 3D file viewer allows stored XSS through glTF extensionsRequired | HIGH 8.7 | 0.4 % | ||
| CVE-2026-28705 | < 1.25.5 | Gitea repository dumps write release assets using unsafe path names | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-28699 | ≤ 1.26.1 | Gitea Basic Auth bypasses OAuth2 access token scopes | HIGH 8.1 | 0.6 % | ||
| CVE-2026-27783 | ≤ 1.26.1 | Gitea issue-template APIs bypass repository unit authorization | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-27780 | < 1.26.0 | Gitea pre-receive hook can miss branch-protection checks after scanner errors | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-27779 | < 1.25.5 | Gitea forwarded-proto handling allows public URL spoofing | HIGH 7.5 | 0.6 % | ||
| CVE-2026-27775 | 1.25.5 | Gitea pre-receive hook permission cache allows full repository write access | HIGH 8.8 | 0.9 % | ||
| CVE-2026-27771 | ≤ 1.26.1 | Gitea Composer package source links use insufficient permission checks | HIGH 8.2 | 1.4 % | ||
| CVE-2026-27761 | ≤ 1.26.2 | Gitea repository feeds bypass API token scope enforcement | MEDIUM 4.3 | 0.5 % | ||
| CVE-2026-27660 | < 1.25.5 | Gitea draft releases use insufficient permission checks | HIGH 7.5 | 0.5 % | ||
| CVE-2026-27657 | < 1.25.5 | Gitea email settings allow changing another user's primary email address | HIGH 7.5 | 0.5 % | ||
| CVE-2026-26307 | < 1.25.5 | Gitea git grep search lacks a timeout | HIGH 7.5 | 0.6 % | ||
| CVE-2026-26292 | < 1.25.5 | Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-26247 | < 1.25.5 | Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-26232 | < 1.25.5 | Gitea OAuth2 authorization codes lack expiry and reuse enforcement | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-26231 | ≤ 1.26.1 | Gitea maintainer-edit permissions allow unauthorized commits to readable repositories | HIGH 8.5 | 0.4 % | ||
| CVE-2026-25782 | < 1.25.5 | Gitea tracked-time deletion can target entries from another issue | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-25779 | ≤ 1.25.4 | Gitea redirect handling permits open redirects through backslash paths | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-25718 | < 1.25.5 | Gitea template repository generation mishandles symlinked paths | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-25714 | ≤ 1.26.1 | Gitea user organization API bypasses public-only token filtering | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-25712 | < 1.25.5 | Gitea organization permission APIs expose private visibility information | HIGH 7.5 | 0.5 % | ||
| CVE-2026-25038 | 1.26.2 | Gitea private organization labels are visible to unauthorized users | HIGH 7.5 | 0.6 % | ||
| CVE-2026-24690 | < 1.25.5 | Gitea pull-request branch updates use insufficient permission checks | HIGH 7.5 | 0.5 % | ||
| CVE-2026-24451 | 1.26.2 | Gitea fork synchronization can expose private parent repository data | HIGH 7.5 | 0.4 % | ||
| CVE-2026-22874 | ≤ 1.26.2 | Gitea webhook and migration allow-list filtering permits SSRF | CRITICAL 9.6 | 0.5 % | ||
| CVE-2026-22555 | < 1.26.0 | Gitea organization forks can expose organization secrets without create permission | HIGH 8.1 | 0.4 % | ||
| CVE-2026-22547 | < 1.25.5 | Gitea repository creation accepts invalid field values | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-20909 | < 1.25.5 | Gitea tracked-time list endpoint has insufficient permission checks | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-20896 | ≤ 1.26.2 | Gitea Docker image trusts spoofable reverse-proxy headers by default | CRITICAL 9.8 | 2.8 % | ||
| CVE-2026-20779 | 1.5.0 – < 1.26.3 | Gitea TOTP single-use enforcement defect allows OTP replay | HIGH 7.1 | 0.5 % | ||
| CVE-2026-20706 | ≤ 1.26.1 | Gitea repository archive downloads bypass token scope checks | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-20912 | ≤ 1.25.3 | Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-20904 | ≤ 1.25.3 | Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-20897 | ≤ 1.25.3 | Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-20888 | ≤ 1.25.3 | Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass) | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-20883 | ≤ 1.25.3 | Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-20800 | ≤ 1.25.3 | Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-20750 | ≤ 1.25.3 | Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR) | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-20736 | ≤ 1.25.3 | Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check | HIGH 7.5 | 0.4 % | ||
| CVE-2026-0798 | ≤ 1.25.3 | Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation | LOW 3.5 | 0.3 % | ||
| CVE-2024-6886 | 1.22.0 | Inproper Sanitation of field leading to stored XSS | CRITICAL 10.0 | 33 % |