CVE-2026-59765 | High | 7.5 | 2026-08-13 | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata |
CVE-2026-59763 | Medium | 4.3 | 2026-08-13 | Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads |
CVE-2026-58511 | Low | 2.7 | 2026-08-13 | Webhook Authorization Header Returned in Plaintext via API |
CVE-2026-58510 | Medium | 4.3 | 2026-08-13 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private |
CVE-2026-58508 | Critical | 9.1 | 2026-08-13 | Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) |
CVE-2026-58507 | Medium | 5.3 | 2026-08-13 | Private Repository Existence Disclosure via go-get Meta Endpoint |
CVE-2026-58445 | Low | 2.7 | 2026-08-13 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API |
CVE-2026-58444 | Medium | 4.3 | 2026-08-13 | Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents |
CVE-2026-58443 | Critical | 9.1 | 2026-08-13 | Public-only repository tokens can update private PR head branches |
CVE-2026-58442 | Medium | 6.5 | 2026-08-13 | Repository migration SSRF via multi-answer DNS allow-list bypass |
CVE-2026-58441 | Medium | 6.3 | 2026-08-13 | SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL |
CVE-2026-58440 | Medium | 6.8 | 2026-08-13 | Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocati… |
CVE-2026-58439 | High | 8.1 | 2026-08-13 | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag |
CVE-2026-58438 | High | 7.5 | 2026-08-13 | Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access |
CVE-2026-58437 | High | 7.1 | 2026-08-13 | Repository Visibility Manipulation via Git Push Options |
CVE-2026-58436 | High | 7.5 | 2026-08-13 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests |
CVE-2026-58435 | Medium | 5.4 | 2026-08-13 | Gitea LFS Deploy-Key Privilege Escalation |
CVE-2026-58434 | High | 7.5 | 2026-08-13 | Private Repository Metadata Remains Accessible After Access Revocation |
CVE-2026-58433 | Critical | 9.1 | 2026-08-13 | Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting |
CVE-2026-58432 | Medium | 5.9 | 2026-08-13 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive… |
CVE-2026-58431 | Medium | 4.3 | 2026-08-13 | Public-only API token restriction is not enforced on team API routes |
CVE-2026-58429 | Medium | 4.9 | 2026-08-13 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints |
CVE-2026-58428 | Medium | 6.5 | 2026-08-13 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) |
CVE-2026-58427 | High | 7.5 | 2026-08-13 | Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 |
CVE-2026-58425 | Medium | 4.3 | 2026-08-13 | OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) |
CVE-2026-58420 | Medium | 4.4 | 2026-08-13 | Local File Inclusion via file:// URI in Migration Restore |
CVE-2026-58417 | High | 7.5 | 2026-08-13 | REST API exposes organization membership of private organizations to public |
CVE-2026-58416 | High | 7.1 | 2026-08-13 | Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) |
CVE-2026-58314 | High | 7.7 | 2026-08-13 | Two SSRF findings in Gitea 1.26.2 |
CVE-2026-57897 | Medium | 6.5 | 2026-08-13 | Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs |
CVE-2026-57894 | High | 8.5 | 2026-08-13 | Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration |
CVE-2026-57886 | Medium | 5.9 | 2026-08-13 | Cross-repository issue/comment attachment re-linking can expose private attachment content |
CVE-2026-56755 | Medium | 6.2 | 2026-08-13 | Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload |
CVE-2026-56750 | Critical | 9.1 | 2026-08-13 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session |
CVE-2026-56657 | Medium | 6.2 | 2026-08-13 | Gitea SSH Key Parser Denial of Service |
CVE-2026-56654 | Critical | 9.8 | 2026-08-13 | Privilege Escalation via Access Token Scope Escalation in API |
CVE-2026-56443 | Critical | 9.6 | 2026-08-13 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 |
CVE-2026-55987 | High | 8.1 | 2026-08-13 | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) |
CVE-2026-55986 | Medium | 5.4 | 2026-08-13 | Email Management API Bypasses ManageCredentials Feature Restrictions |
CVE-2026-55984 | Low | 2.7 | 2026-08-13 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service |
CVE-2026-55982 | Critical | 9.1 | 2026-08-13 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes |
CVE-2026-54481 | High | 7.5 | 2026-08-13 | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) |
CVE-2026-50105 | Medium | 4.3 | 2026-08-13 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) |
CVE-2026-42931 | Medium | 6.5 | 2026-08-13 | Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint |
CVE-2026-24791 | High | 8.1 | 2026-08-13 | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes |
CVE-2026-24059 | Medium | 6.5 | 2026-08-13 | The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if n… |
CVE-2026-23603 | Low | 3.1 | 2026-08-13 | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim |
CVE-2026-34966 | High | 7.6 | 2026-08-05 | Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fe… |
CVE-2026-58426 | Critical | 9.6 | 2026-07-03 | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write |
CVE-2026-58424 | High | 8.9 | 2026-07-03 | Permanent Fork PR Workflow Approval Gate Bypass |
CVE-2026-58423 | High | 7.7 | 2026-07-03 | LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories |
CVE-2026-58422 | Critical | 9.8 | 2026-07-03 | Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts |
CVE-2026-58421 | High | 7.5 | 2026-07-03 | Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service |
CVE-2026-58419 | High | 7.5 | 2026-07-03 | Notification API leaks private issue metadata after access revocation |
CVE-2026-58418 | Medium | 6.5 | 2026-07-03 | SSRF via HTTP Redirect in Repository Migration |
CVE-2026-28744 | High | 8.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks. |
CVE-2026-28740 | High | 7.1 | 2026-07-03 | Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-uni… |
CVE-2026-28737 | High | 8.7 | 2026-07-03 | Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer. |
CVE-2026-28705 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names… |
CVE-2026-28699 | High | 8.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication. |
CVE-2026-27783 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints. |
CVE-2026-27780 | Critical | 9.8 | 2026-07-03 | Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-prot… |
CVE-2026-27779 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation. |
CVE-2026-27775 | High | 8.8 | 2026-07-03 | Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant… |
CVE-2026-27771 | High | 8.2 | 2026-07-03 | Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package s… |
CVE-2026-27761 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository com… |
CVE-2026-27660 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission. |
CVE-2026-27657 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 allow a user to change another user's primary email address. |
CVE-2026-26307 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources. |
CVE-2026-26292 | Critical | 9.8 | 2026-07-03 | Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport prot… |
CVE-2026-26247 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected… |
CVE-2026-26232 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange. |
CVE-2026-26231 | High | 8.5 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read bu… |
CVE-2026-25782 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to… |
CVE-2026-25779 | Medium | 6.1 | 2026-07-03 | Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values. |
CVE-2026-25718 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked o… |
CVE-2026-25714 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE… |
CVE-2026-25712 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations. |
CVE-2026-25038 | High | 7.5 | 2026-07-03 | Gitea 1.26.2 allows unauthorized users to access labels of private organizations. |
CVE-2026-24690 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches. |
CVE-2026-24451 | High | 7.5 | 2026-07-03 | Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be… |
CVE-2026-22874 | Critical | 9.6 | 2026-07-03 | Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering. |
CVE-2026-22555 | High | 8.1 | 2026-07-03 | Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organ… |
CVE-2026-22547 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object for… |
CVE-2026-20909 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries. |
CVE-2026-20896 | Critical | 9.8 | 2026-07-03 | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when revers… |
CVE-2026-20779 | High | 7.1 | 2026-07-03 | Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-fa… |
CVE-2026-20706 | Critical | 9.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint. |
CVE-2026-58053 | Critical | 9.9 | 2026-06-28 | Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when… |
CVE-2026-20912 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be… |
CVE-2026-20904 | Medium | 6.5 | 2026-01-22 | Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other us… |
CVE-2026-20897 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks b… |
CVE-2026-20888 | Medium | 4.3 | 2026-01-22 | Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able t… |
CVE-2026-20883 | Medium | 6.5 | 2026-01-22 | Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue t… |
CVE-2026-20800 | Medium | 6.5 | 2026-01-22 | Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository… |
CVE-2026-20750 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modi… |
CVE-2026-20736 | High | 7.5 | 2026-01-22 | Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete… |
CVE-2026-0798 | Low | 3.5 | 2026-01-22 | Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private… |
CVE-2025-69413 | Medium | 5.3 | 2026-01-01 | In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. |
CVE-2025-68946 | Medium | 5.4 | 2025-12-26 | In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS. |