All errata/p10/ALT-PU-2026-16069-4
ALT-PU-2026-16069-4

Package update gitea in branch p10

Version1.27.3-alt1
Task#433788
Published2026-10-03
Max severityCRITICAL
Severity:

Closed issues (244)

BDU:2026-01994
CRITICAL9.1

Уязвимость системы управления Git-репозиториями Gitea, связанная с ошибками разграничения доступа, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-02-19
CVSS 3.xCRITICAL 9.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0CRITICAL 9.4
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:N
References
BDU:2026-03394
MEDIUM5.3

Уязвимость системы управления Git-репозиториями Gitea, связанная с несоответствием ответов на входящие запросы, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации

Published: 2026-03-18
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
References
BDU:2026-03395
MEDIUM5.3

Уязвимость системы управления Git-репозиториями Gitea, связанная с недостатками процедуры авторизации, позволяющая нарушителю оказать воздействие на доступность защищаемой информации

Published: 2026-03-18
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
References
BDU:2026-07479
HIGH7.5

Уязвимость модели контроля доступа к реестру контейнеров системы управления Git-репозиториями Gitea, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-05-28
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N
References
BDU:2026-09234
CRITICAL9.6

Уязвимость метода HostMatchList.checkIP системы управления Git-репозиториями Gitea, позволяющая нарушителю осуществить SSRF-атаку

Published: 2026-07-05
CVSS 3.xCRITICAL 9.6
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS 2.0HIGH 8.5
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:N
References
BDU:2026-09304
CRITICAL9.8

Уязвимость конфигурации Docker-образа системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Published: 2026-07-06
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
BDU:2026-09517
HIGH8.1

Уязвимость функции CheckRepoScopedToken() системы управления Git-репозиториями Gitea, позволяющая нарушителю повысить свои привилегии

Published: 2026-07-09
CVSS 3.xHIGH 8.1
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0HIGH 8.5
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:N
References
BDU:2026-10561
HIGH7.3

Уязвимость системы управления Git-репозиториями Gitea, связанная с недостатками контроля доступа, позволяющая нарушителю повысить свои привилегии

Published: 2026-07-26
CVSS 3.xHIGH 7.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0HIGH 8.5
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:N
References
BDU:2026-10563
MEDIUM4.3

Уязвимость системы управления Git-репозиториями Gitea, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-07-26
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
References
BDU:2026-10565
CRITICAL9.1

Уязвимость системы управления Git-репозиториями Gitea, связанная с недостатками контроля доступа, позволяющая нарушителю повысить свои привилегии

Published: 2026-07-26
CVSS 3.xCRITICAL 9.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0CRITICAL 9.4
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:N
References
BDU:2026-10566
MEDIUM4.3

Уязвимость системы управления Git-репозиториями Gitea, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-07-26
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
References
BDU:2026-10703
CRITICAL9.8

Уязвимость файла services/repository/files/patch.go системы управления Git-репозиториями Gitea, позволяющая нарушителю выполнить произвольный код и получить несанкционированный доступ к защищаемой информации

Published: 2026-07-29Modified: 2026-10-07
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
BDU:2026-10836
HIGH8.1

Уязвимость механизма проверки областей действия токенов OAuth2 системы управления Git-репозиториями Gitea, позволяющая нарушителю повысить свои привилегии

Published: 2026-07-30
CVSS 3.xHIGH 8.1
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0HIGH 8.5
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:N
References
BDU:2026-12010
HIGH7.5

Уязвимость компонента POST /api/v1/repos/{owner}/{repo}/merge-upstream системы управления Git-репозиториями Gitea, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-08-20
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N
References
BDU:2026-12013
MEDIUM4.3

Уязвимость системы управления Git-репозиториями Gitea, связанная с недостатками механизма авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-08-20
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
References
BDU:2026-13682
MEDIUM6.5

Уязвимость системы управления Git-репозиториями Gitea, связанная с недостаточной проверкой запросов на стороне сервера, позволяющая нарушителю осуществить ssrf-атаку

Published: 2026-09-01
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:N/A:N
References
BDU:2026-14547
MEDIUM5.4

Уязвимость API работы с адресами электронной почты системы управления Git-репозиториями Gitea, позволяющая нарушителю повысить свои привилегии

Published: 2026-09-13
CVSS 3.xMEDIUM 5.4
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0MEDIUM 5.5
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:N
References
BDU:2026-14548
CRITICAL9.1

Уязвимость API привязки репозиториев к командам системы управления Git-репозиториями Gitea, позволяющая нарушителю повысить свои привилегии

Published: 2026-09-13
CVSS 3.xCRITICAL 9.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0CRITICAL 9.4
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:N
References
BDU:2026-14549
CRITICAL9.1

Уязвимость механизма миграции и зеркалирования репозиториев системы управления Git-репозиториями Gitea, позволяющая нарушителю осуществить SSRF-атаку

Published: 2026-09-13
CVSS 3.xCRITICAL 9.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0CRITICAL 9.4
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:N
References
BDU:2026-15369
HIGH7.5

Уязвимость системы управления Git-репозиториями Gitea, связанная с недостатками процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-09-24
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N
References
BDU:2026-15763
CRITICAL9.8

Уязвимость функции CreateAccessToken() файла routers/api/v1/user/app.go и функции reqBasicOrRevProxyAuth() файла routers/api/v1/api.go системы управления Git-репозиториями Gitea, позволяющая нарушителю повысить свои привилегии

Published: 2026-10-01
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:C
References
BDU:2026-15764
MEDIUM6.2

Уязвимость функции parseKeyString() файла models/asymkey/ssh_key_parse.go системы управления Git-репозиториями Gitea, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-10-01
CVSS 3.xMEDIUM 6.2
CVSS:3.x/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2026-15765
MEDIUM4.3

Уязвимость функции updateRepository() файла services/repository/repository.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
References
BDU:2026-15766
CRITICAL9.1

Уязвимость функции UpdatePullRequest() файла routers/api/v1/repo/pull.go системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на целостность и доступность защищаемой информации

Published: 2026-10-01
CVSS 3.xCRITICAL 9.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0HIGH 8.5
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:C/A:C
References
BDU:2026-15767
MEDIUM6.3

Уязвимость функции GetPullRequests() файла services/migrations/restore.go системы управления Git-репозиториями Gitea, позволяющая нарушителю осуществить SSRF-атаку

Published: 2026-10-01
CVSS 3.xMEDIUM 6.3
CVSS:3.x/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:N/A:N
References
BDU:2026-15768
CRITICAL9.1

Уязвимость конечной точки /login/oauth/userinfo системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации

Published: 2026-10-01
CVSS 3.xCRITICAL 9.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0HIGH 8.5
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:N
References
BDU:2026-15769
MEDIUM5.9

Уязвимость функции ServeAttachment(ctx *context.Context, uuid string) файла routers/web/repo/attachment.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 5.9
CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0MEDIUM 5.4
CVSS:2.0/AV:N/AC:H/Au:N/C:C/I:N/A:N
References
BDU:2026-15770
MEDIUM6.5

Уязвимость методов Action.ListWorkflowRuns() и Action.ListWorkflowJobs() файла routers/api/v1/org/action.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:N/A:N
References
BDU:2026-15771
MEDIUM6.5

Уязвимость функции AddPackageTag() файла routers/api/packages/npm/npm.go системы управления Git-репозиториями Gitea, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-10-01
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:C
References
BDU:2026-15772
LOW2.7

Уязвимость функции AddTime() файла routers/api/v1/repo/issue_tracked_time.go системы управления Git-репозиториями Gitea, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-10-01
CVSS 3.xLOW 2.7
CVSS:3.x/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0LOW 3.3
CVSS:2.0/AV:N/AC:L/Au:M/C:N/I:N/A:P
References
BDU:2026-15773
CRITICAL9.1

Уязвимость функции CheckAuthToken() файла services/auth/auth_token.go системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации

Published: 2026-10-01
CVSS 3.xCRITICAL 9.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0CRITICAL 9.4
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:N
References
BDU:2026-15774
MEDIUM6.5

Уязвимость функции ParseControlFile() файла modules/packages/debian/metadata.go системы управления Git-репозиториями Gitea, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-10-01
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:C
References
BDU:2026-15775
HIGH8.5

Уязвимость функции Clone() файла modules/git/repo.go системы управления Git-репозиториями Gitea, позволяющая нарушителю осуществить SSRF-атаку

Published: 2026-10-01
CVSS 3.xHIGH 8.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:P/A:N
References
BDU:2026-15776
HIGH7.1

Уязвимость функции GetActionsUserRepoPermission() файла models/perm/access/repo_permission.go системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации

Published: 2026-10-01
CVSS 3.xHIGH 7.1
CVSS:3.x/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS 2.0MEDIUM 5.6
CVSS:2.0/AV:N/AC:H/Au:S/C:C/I:P/A:N
References
BDU:2026-15777
HIGH7.5

Уязвимость функции ListMembers() файла routers/api/v1/org/member.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N
References
BDU:2026-15778
MEDIUM6.5

Уязвимость функции EditReleasePost() файла routers/web/repo/release.go и функции UpdateRelease() файла services/release/release.go системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на целостность защищаемой информации

Published: 2026-10-01
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:C/A:N
References
BDU:2026-15779
HIGH7.5

Уязвимость конечных точек /api/v1/user/starred и /api/v1/user/subscriptions системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:N/A:N
References
BDU:2026-15780
MEDIUM5.3

Уязвимость функции httpBase() файла routers/web/repo/githttp.go и функции EarlyResponseForGoGetMeta() файла services/context/repo.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
References
BDU:2026-15781
LOW3.1

Уязвимость функции oauth2UpdateAvatarIfNeed() файла routers/web/auth/oauth.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xLOW 3.1
CVSS:3.x/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0LOW 2.1
CVSS:2.0/AV:N/AC:H/Au:S/C:P/I:N/A:N
References
BDU:2026-15782
MEDIUM4.3

Уязвимость обработчиков лент обновлений RSS и Atom системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
References
BDU:2026-15783
MEDIUM5.9

Уязвимость функции UpdateIssueAttachments() файла models/issues/issue_update.go и функции UpdateCommentAttachments() файла models/issues/comment.go системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации

Published: 2026-10-01
CVSS 3.xMEDIUM 5.9
CVSS:3.x/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS 2.0MEDIUM 5.6
CVSS:2.0/AV:N/AC:H/Au:S/C:C/I:P/A:N
References
BDU:2026-15784
MEDIUM4.4

Уязвимость функции (*GiteaLocalUploader).CreateReleases() файла services/migrations/gitea_uploader.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 4.4
CVSS:3.x/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:S/C:C/I:N/A:N
References
BDU:2026-15785
HIGH7.5

Уязвимость функции Locale() файла modules/web/middleware/locale.go системы управления Git-репозиториями Gitea, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-10-01
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2026-15786
HIGH8.1

Уязвимость функции ChangeTargetBranch() файла services/pull/pull.go системы управления Git-репозиториями Gitea, позволяющая нарушителю повысить свои привилегии или обойти ограничения безопасности

Published: 2026-10-01
CVSS 3.xHIGH 8.1
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0HIGH 8.5
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:C/A:C
References
BDU:2026-15787
MEDIUM4.3

Уязвимость системы управления Git-репозиториями Gitea, связанная с использованием имени с неправильной ссылкой, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-10-01
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:P
References
BDU:2026-15788
HIGH7.5

Уязвимость функции Open() файла modules/uri/uri.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:N/A:N
References
BDU:2026-15789
MEDIUM4.3

Уязвимость функции getStarredRepos() файла routers/api/v1/user/star.go и функции ListMyTrackedTimes() файла routers/api/v1/repo/issue_tracked_time.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
References
BDU:2026-15828
MEDIUM6.5

Уязвимость функции IsMigrateURLAllowed() файла services/migrations/migrate.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:N/A:N
References
BDU:2026-15830
HIGH7.5

Уязвимость функции-инициализатора переменной internalAPITransport файла modules/private/internal.go системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Published: 2026-10-01
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:A/AC:H/Au:N/C:C/I:C/A:C
References
BDU:2026-15831
HIGH8.1

Уязвимость функции handleOAuth2SignIn() файла routers/web/auth/oauth.go системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации

Published: 2026-10-01
CVSS 3.xHIGH 8.1
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0HIGH 8.5
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:N
References
BDU:2026-15832
CRITICAL9.6

Уязвимость файлов routers/api/v1/api.go, routers/api/packages/api.go, services/context/api.go, services/context/permission.go системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на целостность и доступность защищаемой информации

Published: 2026-10-01
CVSS 3.xCRITICAL 9.6
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
CVSS 2.0HIGH 8.5
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:C/A:C
References
BDU:2026-15833
HIGH7.7

Уязвимость функции (*HostMatchList).checkIP() файла modules/hostmatcher/hostmatcher.go и функции RedirectURL() файла modules/auth/openid/openid.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xHIGH 7.7
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:N/A:N
References
BDU:2026-15834
HIGH7.5

Уязвимость функции IsPublicMember() файла routers/api/v1/org/member.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:N/A:N
References
BDU:2026-15835
MEDIUM4.3

Уязвимость функции IntrospectOAuth() файла routers/web/auth/oauth2_provider.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
References
BDU:2026-15836
MEDIUM4.9

Уязвимость конечных точек /api/v1/user/orgs и /api/v1/users/{username}/orgs/{org}/permissions системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 4.9
CVSS:3.x/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0MEDIUM 6.1
CVSS:2.0/AV:N/AC:L/Au:M/C:C/I:N/A:N
References
BDU:2026-15837
MEDIUM4.3

Уязвимость конечных точек /api/v1/teams/{teamid} системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
References
BDU:2026-15838
MEDIUM5.4

Уязвимость файлов services/lfs/server.go и routers/private/serv.go системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации

Published: 2026-10-01
CVSS 3.xMEDIUM 5.4
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0MEDIUM 5.5
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:N
References
BDU:2026-15839
HIGH7.1

Уязвимость функции HookPostReceive() файла routers/private/hook_post_receive.go системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации

Published: 2026-10-01
CVSS 3.xHIGH 7.1
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:C/A:N
References
BDU:2026-15840
MEDIUM6.8

Уязвимость функции DeleteCollaboration() файла services/repository/collaboration.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 6.8
CVSS:3.x/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS 2.0MEDIUM 6.1
CVSS:2.0/AV:N/AC:L/Au:M/C:C/I:N/A:N
References
BDU:2026-15841
MEDIUM4.3

Уязвимость маршрута /{owner}/{repo} системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
References
BDU:2026-15842
LOW2.7

Уязвимость функции DeleteIssueLabel() файла routers/api/v1/repo/issue_label.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xLOW 2.7
CVSS:3.x/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0LOW 3.3
CVSS:2.0/AV:N/AC:L/Au:M/C:P/I:N/A:N
References
BDU:2026-15843
LOW2.7

Уязвимость функции ToHook() файла services/webhook/general.go системы управления Git-репозиториями Gitea, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2026-10-01
CVSS 3.xLOW 2.7
CVSS:3.x/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0LOW 3.3
CVSS:2.0/AV:N/AC:L/Au:M/C:P/I:N/A:N
References
CVE-2026-0798
LOW3.5

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.

Published: 2026-01-22Modified: 2026-06-17
CVSS 3.xLOW 3.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
References
CVE-2026-20706
CRITICAL9.1

Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.

Published: 2026-07-03Modified: 2026-07-06
CVSS 3.xCRITICAL 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
CVE-2026-20736
HIGH7.5

Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.

Published: 2026-01-22Modified: 2026-07-14
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
CVE-2026-20750
CRITICAL9.1

Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.

Published: 2026-01-22Modified: 2026-07-14
CVSS 3.xCRITICAL 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
CVE-2026-20779
HIGH7.1

Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.

Published: 2026-07-03Modified: 2026-07-07
CVSS 3.xHIGH 7.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
References
CVE-2026-20800
MEDIUM6.5

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.

Published: 2026-01-22Modified: 2026-06-17
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
CVE-2026-20883
MEDIUM6.5

Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.

Published: 2026-01-22Modified: 2026-06-17
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
CVE-2026-20888
MEDIUM4.3

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users.

Published: 2026-01-22Modified: 2026-06-17
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-20896
CRITICAL9.8

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

Published: 2026-07-03Modified: 2026-07-07
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2026-20897
CRITICAL9.1

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.

Published: 2026-01-22Modified: 2026-07-14
CVSS 3.xCRITICAL 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
CVE-2026-20904
MEDIUM6.5

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

Published: 2026-01-22Modified: 2026-06-17
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
CVE-2026-20912
CRITICAL9.1

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.

Published: 2026-01-22Modified: 2026-07-14
CVSS 3.xCRITICAL 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
CVE-2026-22874
CRITICAL9.6

Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

Published: 2026-07-03Modified: 2026-07-07
CVSS 3.xCRITICAL 9.6
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References
CVE-2026-24451
HIGH7.5

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

Published: 2026-07-03Modified: 2026-07-07
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
CVE-2026-24791
HIGH8.1

Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
CVE-2026-25038
HIGH7.5

Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

Published: 2026-07-03Modified: 2026-07-07
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
CVE-2026-25714
MEDIUM4.3

Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.

Published: 2026-07-03Modified: 2026-07-07
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-25946
MEDIUM5.3

When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-26231
HIGH8.5

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

Published: 2026-07-03Modified: 2026-07-07
CVSS 3.xHIGH 8.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
References
CVE-2026-27761
MEDIUM4.3

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

Published: 2026-07-03Modified: 2026-07-07
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-27771
HIGH8.2

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

Published: 2026-07-03Modified: 2026-07-07
CVSS 3.xHIGH 8.2
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
CVE-2026-27775
HIGH8.8

Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

Published: 2026-07-03Modified: 2026-07-06
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
CVE-2026-27783
MEDIUM4.3

Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.

Published: 2026-07-03Modified: 2026-07-06
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-28699
HIGH8.1

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

Published: 2026-07-03Modified: 2026-07-06
CVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
CVE-2026-28740
HIGH7.1

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

Published: 2026-07-03Modified: 2026-07-07
CVSS 3.xHIGH 7.1
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
References
CVE-2026-28744
HIGH8.1

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

Published: 2026-07-03Modified: 2026-07-06
CVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
CVE-2026-50105
MEDIUM4.3

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-55987
HIGH8.1

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
CVE-2026-56443
CRITICAL9.6

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xCRITICAL 9.6
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
References
CVE-2026-57894
HIGH8.5

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xHIGH 8.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
References
CVE-2026-58418
MEDIUM6.5

SSRF via HTTP Redirect in Repository Migration

Published: 2026-07-03Modified: 2026-07-06
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
CVE-2026-58419
HIGH7.5

Notification API leaks private issue metadata after access revocation

Published: 2026-07-03Modified: 2026-07-06
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
CVE-2026-58421
HIGH7.5

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Published: 2026-07-03Modified: 2026-07-06
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
CVE-2026-58422
CRITICAL9.8

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Published: 2026-07-03Modified: 2026-07-06
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2026-58423
HIGH7.7

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Published: 2026-07-03Modified: 2026-07-06
CVSS 3.xHIGH 7.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
CVE-2026-58425
MEDIUM4.3

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-58426
CRITICAL9.6

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Published: 2026-07-03Modified: 2026-07-06
CVSS 3.xCRITICAL 9.6
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References
CVE-2026-58428
MEDIUM6.5

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
CVE-2026-58432
MEDIUM5.9

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xMEDIUM 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References
CVE-2026-58433
CRITICAL9.1

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xCRITICAL 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
CVE-2026-58438
HIGH7.5

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
CVE-2026-58440
MEDIUM6.8

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xMEDIUM 6.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
References
CVE-2026-58444
MEDIUM4.3

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-59763
MEDIUM4.3

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
CVE-2026-59765
HIGH7.5

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Published: 2026-08-13Modified: 2026-08-26
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
CVE-2026-59766
MEDIUM4.3

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-59774
CRITICAL9.8

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.

Published: 2026-10-14Modified: 2026-10-15
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2026-60004
CRITICAL9.8

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Published: 2026-08-26Modified: 2026-08-27
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2026-60008
LOW3.5

Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xLOW 3.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
References
CVE-2026-60010
MEDIUM6.5

Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access.

Published: 2026-10-14Modified: 2026-10-15
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
CVE-2026-60018
MEDIUM6.5

Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or never-ending response. This can consume memory and hold migration workers, impairing service availability.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
CVE-2026-60021
NONE

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.

Published: 2026-10-14Modified: 2026-10-14
References
CVE-2026-62925
MEDIUM6.5

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionately large memory allocations during parsing and metadata generation. On memory-constrained deployments, this can terminate the process or otherwise disrupt availability.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
CVE-2026-63021
MEDIUM6.5

Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause request failures.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
CVE-2026-63792
MEDIUM5.3

Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through collaborative-owner configuration. The issue exposes private reusable workflow contents at caller-selected Git refs; it does not itself grant write access or code execution in the other repository.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
References
CVE-2026-66849
MEDIUM4.3

Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects user-owned package registries and exposes package contents across the intended authorization boundary.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-66853
MEDIUM4.3

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-66874
MEDIUM6.5

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from running. Because skipped statuses count as success, branch protection or organization-required workflow checks can appear satisfied without the mandated workflow executing; no runner or maintainer approval is required for this path.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
CVE-2026-66877
HIGH8.1

Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.

Published: 2026-10-14Modified: 2026-10-15
CVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
CVE-2026-67577
MEDIUM4.3

Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity can include repository names, commit messages, and issue or pull request events associated with qualifying public-repository activity.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-68957
MEDIUM4.3

Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also reveal that hidden issue content or comments contain a supplied term.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-68964
MEDIUM4.3

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key material and associated metadata, not private cryptographic keys.

Published: 2026-10-14Modified: 2026-10-14
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-73278
CRITICAL9.8

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.

Published: 2026-10-06Modified: 2026-10-13
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2026-73535
NONE

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.

Published: 2026-10-14Modified: 2026-10-14
References
CVE-2026-73539
NONE

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.

Published: 2026-10-14Modified: 2026-10-14
References
CVE-2026-73800
NONE

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.

Published: 2026-10-14Modified: 2026-10-14
References
CVE-2026-73804
NONE

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.

Published: 2026-10-14Modified: 2026-10-14
References
CVE-2026-73814
NONE

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.

Published: 2026-10-14Modified: 2026-10-14
References
CVE-2026-78433
NONE

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.

Published: 2026-10-14Modified: 2026-10-14
References
GHSA-25gq-j9jx-43pg
MEDIUM6.5

Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Published: 2026-07-21
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
GHSA-2fcr-jfvc-vgg2
HIGH7.7

Gitea: Two SSRF findings

Published: 2026-07-21Modified: 2026-09-24
CVSS 3.xHIGH 7.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
GHSA-2m9v-5q2g-58vq
HIGH7.1

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Published: 2026-07-21
CVSS 3.xHIGH 7.1
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
References
GHSA-2r5c-gw76-rh3w
CRITICAL9.6

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Published: 2026-07-21
CVSS 3.xCRITICAL 9.6
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References
GHSA-2vgv-hgv4-22mh
LOW2.3

Gitea improperly exposes issue and pull request titles

Published: 2026-01-23Modified: 2026-01-23
CVSS 4.0LOW 2.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
GHSA-2wm4-vwp6-v7xc
MEDIUM6.9

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Published: 2026-07-21Modified: 2026-09-24
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 4.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
References
GHSA-393c-qgvj-3xph
MEDIUM5.3

Gitea does not properly validate repository ownership when deleting Git LFS locks

Published: 2026-01-23Modified: 2026-01-23
CVSS 4.0MEDIUM 5.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
GHSA-3pww-vcvm-3gmj
MEDIUM4.3

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Published: 2026-07-21
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-44qc-pgvp-wx7v
HIGH7.5

Gitea: Notification API leaks private issue metadata after access revocation

Published: 2026-07-21
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
GHSA-4xjf-493q-98p3
MEDIUM6.9

Gitea SSH Key Parser Denial of Service

Published: 2026-07-21Modified: 2026-09-24
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 4.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
GHSA-4xx9-vc8v-87hv
MEDIUM5.1

Gitea does not properly validate repository ownership when linking attachments to releases

Published: 2026-01-23Modified: 2026-01-23
CVSS 4.0MEDIUM 5.1
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
GHSA-649p-mmhf-85c7
HIGH8.8

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Published: 2026-07-21
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
GHSA-66m4-5jjr-2rg5
MEDIUM6.8

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Published: 2026-07-21
CVSS 3.xMEDIUM 6.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
References
GHSA-683j-3ff6-hh2x
HIGH8.7

Gitea: Privilege Escalation via Access Token Scope Escalation in API

Published: 2026-07-21Modified: 2026-07-21
CVSS 4.0HIGH 8.7
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
GHSA-6c6r-5xr4-cr5m
MEDIUM5.9

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Published: 2026-07-21
CVSS 3.xMEDIUM 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
References
GHSA-6hm7-3pwj-22rm
HIGH7.1

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Published: 2026-07-21
CVSS 4.0HIGH 7.1
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
GHSA-777r-4v59-6486
HIGH8.9

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Published: 2026-07-21
CVSS 3.xHIGH 8.9
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H
References
GHSA-7p4h-3gxq-x3h3
MEDIUM4.3

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Published: 2026-07-21Modified: 2026-09-24
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-7wvc-rvp7-w99x
HIGH7.7

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Published: 2026-07-21Modified: 2026-07-21
CVSS 3.xHIGH 7.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
GHSA-8fwc-qjw5-rvgp
LOW2.3

Gitea may send release notification emails for private repositories to users whose access has been revoked

Published: 2026-01-23Modified: 2026-01-23
CVSS 4.0LOW 2.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
GHSA-8qw8-rq86-9pc2
HIGH8.2

Gitea has insufficient permission checks for Composer package source links

Published: 2026-07-17
CVSS 3.xHIGH 8.2
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
GHSA-9cgq-wp42-4rpq
MEDIUM5.3

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface

Published: 2026-01-23Modified: 2026-01-23
CVSS 4.0MEDIUM 5.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
GHSA-9mq6-mqjj-c2c5
MEDIUM5.3

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Published: 2026-07-21
CVSS 4.0MEDIUM 5.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
GHSA-cm54-pfmc-xrwx
MEDIUM4.3

Gitea mishandles authorization for deletion of releases

Published: 2025-12-26Modified: 2025-12-26
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
GHSA-f75j-4cw6-rmx4
CRITICAL9.8

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Published: 2026-07-21
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
GHSA-fj8v-hjwv-qm88
MEDIUM6.3

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Published: 2026-07-21
CVSS 3.xMEDIUM 6.3
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
References
GHSA-fq2p-5p22-8g6j
MEDIUM4.9

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Published: 2026-07-21
CVSS 3.xMEDIUM 4.9
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
References
GHSA-fw57-jgch-pgf3
HIGH8.7

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Published: 2026-07-21
CVSS 4.0HIGH 8.7
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
GHSA-g9g6-qhrc-p3qc
HIGH7.6

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Published: 2026-07-21
CVSS 4.0HIGH 7.6
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
GHSA-gx3v-q759-g323
HIGH7.1

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Published: 2026-07-21
CVSS 3.xHIGH 7.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
References
GHSA-hg5r-vq93-9fv6
CRITICAL9.6

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Published: 2026-07-21
CVSS 3.xCRITICAL 9.6
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References
GHSA-hgr3-x44x-33hx
LOW2.3

Gitea has improper access control for uploaded attachments

Published: 2026-01-23Modified: 2026-01-23
CVSS 4.0LOW 2.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
GHSA-j2w3-9c3r-g83q
LOW2.3

Gitea: Private Repository Metadata Remains Accessible After Access Revocation

Published: 2026-07-21
CVSS 4.0LOW 2.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
GHSA-j8xr-c56q-m8jj
LOW2.3

Gitea improperly exposes issue titles and repository names through previously started stopwatches

Published: 2026-01-23Modified: 2026-01-23
CVSS 4.0LOW 2.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
GHSA-jr5x-6h83-wrxf
MEDIUM5.3

Gitea: REST API exposes organization membership of private organizations to public

Published: 2026-07-21
CVSS 4.0MEDIUM 5.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
GHSA-pc73-rj2c-wvf9
MEDIUM5.3

Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists

Published: 2026-01-01Modified: 2026-01-02
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
GHSA-q9pg-jj6x-j9p6
MEDIUM5.9

Gitea: draft release attachment disclosure via missing web authorization

Published: 2026-07-21
CVSS 3.xMEDIUM 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References
GHSA-qqgv-v353-cv8p
MEDIUM5.3

Gitea does not properly validate ownership when toggling OpenID URI visibility

Published: 2026-01-23Modified: 2026-01-23
CVSS 4.0MEDIUM 5.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
GHSA-rcr6-4jqh-j84m
CRITICAL9.8

Gitea: Remote Code Execution via diffpatch Git Hook Installation

Published: 2026-09-08
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
GHSA-rgv6-xp99-6mgj
CRITICAL9.1

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Published: 2026-07-21
CVSS 4.0CRITICAL 9.1
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
GHSA-rqhx-647v-wx32
MEDIUM6.5

Gitea: SSRF via HTTP Redirect in Repository Migration

Published: 2026-07-21
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
GHSA-rw22-5hhq-pfpf
MEDIUM5.3

Gitea does not properly validate project ownership in organization project operations

Published: 2026-01-23Modified: 2026-01-23
CVSS 4.0MEDIUM 5.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
GHSA-v73x-hx65-6pf4
HIGH7.5

Gitea: Unauthorized Access to Labels of Private Organizations

Published: 2026-07-21Modified: 2026-07-21
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
GHSA-v96j-25gv-g2w9
HIGH7.5

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Published: 2026-07-21
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-vxv2-8j6r-pcpg
MEDIUM4.3

Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Published: 2026-07-21
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-w5pg-649r-p6gg
HIGH8.1

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Published: 2026-07-21Modified: 2026-07-21
CVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
References
GHSA-wrf9-r3h7-7x5v
HIGH7.5

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Published: 2026-07-21
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
GHSA-x77v-q46j-393g
LOW3.1

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Published: 2026-07-21
CVSS 3.xLOW 3.1
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
References