ALT-PU-2026-14127-1

BDU:2026-09234

CRITICAL9.6

Уязвимость метода HostMatchList.checkIP системы управления Git-репозиториями Gitea, позволяющая нарушителю осуществить SSRF-атаку

Published: 2026-07-05

CVSS 3.xCRITICAL 9.6

CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CVSS 2.0HIGH 8.5

CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:N

References

BDU:2026-09304

CRITICAL9.8

Уязвимость конфигурации Docker-образа системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Published: 2026-07-06

CVSS 3.xCRITICAL 9.8

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0CRITICAL 10.0

CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C

References

BDU:2026-10703

CRITICAL9.8

Уязвимость файла services/repository/files/patch.go системы управления Git-репозиториями Gitea, позволяющая нарушителю выполнить произвольный код и получить несанкционированный доступ к защищаемой информации

Published: 2026-07-29Modified: 2026-08-25

CVSS 3.xCRITICAL 9.8

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0CRITICAL 10.0

CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C

References

BDU:2026-12010

HIGH7.5

Уязвимость компонента POST /api/v1/repos/{owner}/{repo}/merge-upstream системы управления Git-репозиториями Gitea, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-08-20

CVSS 3.xHIGH 7.5

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS 2.0HIGH 7.8

CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N

References

BDU:2026-12013

MEDIUM4.3

Уязвимость системы управления Git-репозиториями Gitea, связанная с недостатками механизма авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-08-20

CVSS 3.xMEDIUM 4.3

CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS 2.0MEDIUM 4.0

CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N

References

CVE-2026-20779

HIGH7.1

Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.

Published: 2026-07-03Modified: 2026-07-07

CVSS 3.xHIGH 7.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

CVE-2026-20896

CRITICAL9.8

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

Published: 2026-07-03Modified: 2026-07-07

CVSS 3.xCRITICAL 9.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

CVE-2026-22874

CRITICAL9.6

Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

Published: 2026-07-03Modified: 2026-07-07

CVSS 3.xCRITICAL 9.6

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References

CVE-2026-23603

LOW3.1

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xLOW 3.1

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-24451

HIGH7.5

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

Published: 2026-07-03Modified: 2026-07-07

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-25038

HIGH7.5

Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

Published: 2026-07-03Modified: 2026-07-07

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-25946

NONE

CVE-2026-27761

MEDIUM4.3

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

Published: 2026-07-03Modified: 2026-07-07

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-27775

HIGH8.8

Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

Published: 2026-07-03Modified: 2026-07-06

CVSS 3.xHIGH 8.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

CVE-2026-28740

HIGH7.1

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

Published: 2026-07-03Modified: 2026-07-07

CVSS 3.xHIGH 7.1

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

CVE-2026-42931

MEDIUM6.5

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

CVE-2026-50105

MEDIUM4.3

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-54481

HIGH7.5

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

CVE-2026-55982

CRITICAL9.1

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xCRITICAL 9.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

CVE-2026-55984

LOW2.7

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xLOW 2.7

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

References

CVE-2026-55986

MEDIUM5.4

Email Management API Bypasses ManageCredentials Feature Restrictions

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 5.4

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

CVE-2026-55987

HIGH8.1

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 8.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

CVE-2026-56443

CRITICAL9.6

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xCRITICAL 9.6

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

References

CVE-2026-56654

CRITICAL9.8

Privilege Escalation via Access Token Scope Escalation in API

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xCRITICAL 9.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

CVE-2026-56657

MEDIUM6.2

Gitea SSH Key Parser Denial of Service

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 6.2

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

CVE-2026-56750

CRITICAL9.1

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xCRITICAL 9.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

CVE-2026-56755

MEDIUM6.2

Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 6.2

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

CVE-2026-57886

MEDIUM5.9

Cross-repository issue/comment attachment re-linking can expose private attachment content

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 5.9

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

References

CVE-2026-57894

HIGH8.5

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 8.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

CVE-2026-57897

MEDIUM6.5

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-58314

HIGH7.7

Two SSRF findings in Gitea 1.26.2

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 7.7

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

CVE-2026-58416

HIGH7.1

Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 7.1

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

CVE-2026-58417

HIGH7.5

REST API exposes organization membership of private organizations to public

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-58418

MEDIUM6.5

SSRF via HTTP Redirect in Repository Migration

Published: 2026-07-03Modified: 2026-07-06

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-58419

HIGH7.5

Notification API leaks private issue metadata after access revocation

Published: 2026-07-03Modified: 2026-07-06

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-58420

MEDIUM4.4

Local File Inclusion via file:// URI in Migration Restore

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 4.4

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-58421

HIGH7.5

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Published: 2026-07-03Modified: 2026-07-06

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

CVE-2026-58422

CRITICAL9.8

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Published: 2026-07-03Modified: 2026-07-06

CVSS 3.xCRITICAL 9.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

CVE-2026-58423

HIGH7.7

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Published: 2026-07-03Modified: 2026-07-06

CVSS 3.xHIGH 7.7

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

CVE-2026-58424

HIGH8.9

Permanent Fork PR Workflow Approval Gate Bypass

Published: 2026-07-03Modified: 2026-07-06

CVSS 3.xHIGH 8.9

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H

References

CVE-2026-58425

MEDIUM4.3

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-58427

HIGH7.5

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-58428

MEDIUM6.5

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

CVE-2026-58429

MEDIUM4.9

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 4.9

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-58431

MEDIUM4.3

Public-only API token restriction is not enforced on team API routes

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-58432

MEDIUM5.9

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 5.9

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-58433

CRITICAL9.1

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xCRITICAL 9.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

CVE-2026-58434

HIGH7.5

Private Repository Metadata Remains Accessible After Access Revocation

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-58435

MEDIUM5.4

Gitea LFS Deploy-Key Privilege Escalation

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 5.4

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

CVE-2026-58436

HIGH7.5

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

CVE-2026-58437

HIGH7.1

Repository Visibility Manipulation via Git Push Options

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 7.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References

CVE-2026-58438

HIGH7.5

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-58439

HIGH8.1

Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 8.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

CVE-2026-58440

MEDIUM6.8

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 6.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

CVE-2026-58441

MEDIUM6.3

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 6.3

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

CVE-2026-58442

MEDIUM6.5

Repository migration SSRF via multi-answer DNS allow-list bypass

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-58443

CRITICAL9.1

Public-only repository tokens can update private PR head branches

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xCRITICAL 9.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

CVE-2026-58444

MEDIUM4.3

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-58445

LOW2.7

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xLOW 2.7

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-58507

MEDIUM5.3

Private Repository Existence Disclosure via go-get Meta Endpoint

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 5.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-58508

CRITICAL9.1

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xCRITICAL 9.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

CVE-2026-58510

MEDIUM4.3

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-58511

LOW2.7

Webhook Authorization Header Returned in Plaintext via API

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xLOW 2.7

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

CVE-2026-59763

MEDIUM4.3

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

CVE-2026-59765

HIGH7.5

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Published: 2026-08-13Modified: 2026-08-26

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2026-59766

NONE

CVE-2026-59774

NONE

CVE-2026-60004

CRITICAL9.8

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Published: 2026-08-26Modified: 2026-08-27

CVSS 3.xCRITICAL 9.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

NONE

NONE

NONE

NONE

NONE

NONE

NONE

MEDIUM6.5

Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Published: 2026-07-21

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

GHSA-2fcr-jfvc-vgg2

HIGH7.7

Gitea: Two SSRF findings

Published: 2026-07-21

CVSS 3.xHIGH 7.7

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

GHSA-2m9v-5q2g-58vq

HIGH7.1

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Published: 2026-07-21

CVSS 3.xHIGH 7.1

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

GHSA-2r5c-gw76-rh3w

CRITICAL9.6

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Published: 2026-07-21

CVSS 3.xCRITICAL 9.6

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References

GHSA-2wm4-vwp6-v7xc

MEDIUM6.9

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Published: 2026-07-21

CVSS 4.0

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References

GHSA-3pww-vcvm-3gmj

MEDIUM4.3

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Published: 2026-07-21

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GHSA-3r5c-2xxx-h872

LOW2.7

Gitea: Webhook Authorization Header Returned in Plaintext via API

Published: 2026-07-21

CVSS 3.xLOW 2.7

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

GHSA-44qc-pgvp-wx7v

HIGH7.5

Gitea: Notification API leaks private issue metadata after access revocation

Published: 2026-07-21

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GHSA-4xjf-493q-98p3

MEDIUM6.9

Gitea SSH Key Parser Denial of Service

Published: 2026-07-21Modified: 2026-07-21

CVSS 4.0

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

GHSA-5ggr-2f2h-jmvm

MEDIUM6.7

Gitea: Local File Inclusion via file:// URI in Migration Restore

Published: 2026-07-21

CVSS 4.0MEDIUM 6.7

CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

GHSA-649p-mmhf-85c7

HIGH8.8

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Published: 2026-07-21

CVSS 3.xHIGH 8.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GHSA-66m4-5jjr-2rg5

MEDIUM6.8

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Published: 2026-07-21

CVSS 3.xMEDIUM 6.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

GHSA-683j-3ff6-hh2x

HIGH8.7

Gitea: Privilege Escalation via Access Token Scope Escalation in API

Published: 2026-07-21Modified: 2026-07-21

CVSS 4.0HIGH 8.7

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

GHSA-6c6r-5xr4-cr5m

MEDIUM5.9

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Published: 2026-07-21

CVSS 3.xMEDIUM 5.9

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

References

GHSA-6cqf-375w-639g

MEDIUM4.3

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Published: 2026-07-21

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GHSA-6hm7-3pwj-22rm

HIGH7.1

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Published: 2026-07-21

CVSS 4.0HIGH 7.1

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

GHSA-777r-4v59-6486

HIGH8.9

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Published: 2026-07-21

CVSS 3.xHIGH 8.9

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H

References

GHSA-7p4h-3gxq-x3h3

MEDIUM4.3

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Published: 2026-07-21

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GHSA-7wvc-rvp7-w99x

HIGH7.7

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Published: 2026-07-21Modified: 2026-07-21

CVSS 3.xHIGH 7.7

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

GHSA-82f7-87hm-852x

HIGH8.5

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Published: 2026-07-21Modified: 2026-07-21

CVSS 3.xHIGH 8.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

GHSA-8p9h-49rc-qgxj

HIGH7.1

Gitea: Repository Visibility Manipulation via Git Push Options

Published: 2026-07-21

CVSS 3.xHIGH 7.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References

GHSA-94v3-77j7-vm48

HIGH7.5

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Published: 2026-07-21

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GHSA-9mq6-mqjj-c2c5

MEDIUM5.3

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Published: 2026-07-21

CVSS 4.0MEDIUM 5.3

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

GHSA-cp3q-vrj2-ghhh

MEDIUM4.3

Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Published: 2026-07-21

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GHSA-f75j-4cw6-rmx4

CRITICAL9.8

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Published: 2026-07-21

CVSS 3.xCRITICAL 9.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GHSA-fj8v-hjwv-qm88

MEDIUM6.3

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Published: 2026-07-21

CVSS 3.xMEDIUM 6.3

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

References

GHSA-fq2p-5p22-8g6j

MEDIUM4.9

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Published: 2026-07-21

CVSS 3.xMEDIUM 4.9

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

GHSA-frpw-3h2q-4jj6

MEDIUM6.5

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Published: 2026-07-21

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GHSA-fw57-jgch-pgf3

HIGH8.7

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Published: 2026-07-21

CVSS 4.0HIGH 8.7

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

GHSA-g9g6-qhrc-p3qc

HIGH7.6

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Published: 2026-07-21

CVSS 4.0HIGH 7.6

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

GHSA-gx3v-q759-g323

HIGH7.1

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Published: 2026-07-21

CVSS 3.xHIGH 7.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

GHSA-h2x6-g7q6-344v

MEDIUM6.5

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Published: 2026-07-21

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GHSA-h56g-4qw7-2mxg

MEDIUM4.3

Gitea: Public-only API token restriction is not enforced on team API routes

Published: 2026-07-21

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GHSA-j2w3-9c3r-g83q

LOW2.3

Gitea: Private Repository Metadata Remains Accessible After Access Revocation

Published: 2026-07-21

CVSS 4.0LOW 2.3

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

GHSA-jr5x-6h83-wrxf

MEDIUM5.3

Gitea: REST API exposes organization membership of private organizations to public

Published: 2026-07-21

CVSS 4.0MEDIUM 5.3

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

GHSA-m932-crvm-gcp5

LOW2.7

Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Published: 2026-07-21

CVSS 3.xLOW 2.7

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

References

GHSA-mg4f-x9v4-6h2p

MEDIUM5.3

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Published: 2026-07-21

CVSS 4.0MEDIUM 5.3

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

GHSA-p4mj-98mv-xq26

MEDIUM5.3

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

Published: 2026-07-21

CVSS 3.xMEDIUM 5.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GHSA-pgqf-926r-548m

LOW2.7

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Published: 2026-07-21

CVSS 3.xLOW 2.7

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

GHSA-prr9-9mp4-5gp2

NONE

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Published: 2026-07-21

References

GHSA-q423-49rw-g9mh

MEDIUM4.3

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Published: 2026-07-21

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GHSA-q9pg-jj6x-j9p6

MEDIUM5.9

Gitea: draft release attachment disclosure via missing web authorization

Published: 2026-07-21

CVSS 3.xMEDIUM 5.9

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GHSA-qf2f-qh6p-7v89

MEDIUM4.3

Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

Published: 2026-07-21

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GHSA-rgv6-xp99-6mgj

CRITICAL9.1

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Published: 2026-07-21

CVSS 4.0CRITICAL 9.1

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

GHSA-rh79-75qm-gwjr

MEDIUM5.4

Gitea LFS Deploy-Key Privilege Escalation

Published: 2026-07-21

CVSS 3.xMEDIUM 5.4

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

GHSA-rqhx-647v-wx32

MEDIUM6.5

Gitea: SSRF via HTTP Redirect in Repository Migration

Published: 2026-07-21

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GHSA-v73x-hx65-6pf4

HIGH7.5

Gitea: Unauthorized Access to Labels of Private Organizations

Published: 2026-07-21Modified: 2026-07-21

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GHSA-v96j-25gv-g2w9

HIGH7.5

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Published: 2026-07-21

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GHSA-vrhc-jjfc-m3m3

HIGH8.1

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Published: 2026-07-21

CVSS 3.xHIGH 8.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GHSA-vxv2-8j6r-pcpg

MEDIUM4.3

Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Published: 2026-07-21

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GHSA-w5pg-649r-p6gg

HIGH8.1

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Published: 2026-07-21Modified: 2026-07-21

CVSS 3.xHIGH 8.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

GHSA-wrf9-r3h7-7x5v

HIGH7.5

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Published: 2026-07-21

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GHSA-wwqq-x6w4-frm2

MEDIUM6.5

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Published: 2026-07-21

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GHSA-x77v-q46j-393g

LOW3.1

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Published: 2026-07-21

CVSS 3.xLOW 3.1

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GHSA-xmj7-xj85-hfc3

MEDIUM6.3

Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Published: 2026-07-21

CVSS 3.xMEDIUM 6.3

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

GHSA-xv9x-fj9g-vj6h

LOW2.3

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Published: 2026-07-21

CVSS 4.0LOW 2.3

CVSS:4.0/CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

References

GHSA-xxjv-752h-3vp2

CRITICAL9.6

Gitea: Public-only repository tokens can update private PR head branches

Published: 2026-07-21

CVSS 3.xCRITICAL 9.6

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

References

Package update gitea in branch sisyphus

Closed issues (132)

Уязвимость метода HostMatchList.checkIP системы управления Git-репозиториями Gitea, позволяющая нарушителю осуществить SSRF-атаку

Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Email Management API Bypasses ManageCredentials Feature Restrictions

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Privilege Escalation via Access Token Scope Escalation in API

Gitea SSH Key Parser Denial of Service

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Cross-repository issue/comment attachment re-linking can expose private attachment content

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Two SSRF findings in Gitea 1.26.2

Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

REST API exposes organization membership of private organizations to public

SSRF via HTTP Redirect in Repository Migration

Notification API leaks private issue metadata after access revocation

Local File Inclusion via file:// URI in Migration Restore

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Permanent Fork PR Workflow Approval Gate Bypass

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Public-only API token restriction is not enforced on team API routes

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Private Repository Metadata Remains Accessible After Access Revocation

Gitea LFS Deploy-Key Privilege Escalation

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Repository Visibility Manipulation via Git Push Options

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Repository migration SSRF via multi-answer DNS allow-list bypass

Public-only repository tokens can update private PR head branches

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Private Repository Existence Disclosure via go-get Meta Endpoint

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Webhook Authorization Header Returned in Plaintext via API

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Gitea: Two SSRF findings

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Gitea: Webhook Authorization Header Returned in Plaintext via API

Gitea: Notification API leaks private issue metadata after access revocation

Gitea SSH Key Parser Denial of Service

Gitea: Local File Inclusion via file:// URI in Migration Restore

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea: Permanent Fork PR Workflow Approval Gate Bypass