Gitea
Page 2 of 2 — Gitea CVEs from a corpus of 142, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68945 | Medium | 5.8 | 2025-12-26 | In Gitea before 1.21.2, an anonymous user can visit a private user's project. |
CVE-2025-68944 | Medium | 5.0 | 2025-12-26 | Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries. |
CVE-2025-68943 | Medium | 5.3 | 2025-12-26 | Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order. |
CVE-2025-68942 | Medium | 5.4 | 2025-12-26 | Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text. |
CVE-2025-68941 | Medium | 4.9 | 2025-12-26 | Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources. |
CVE-2025-68940 | Low | 3.1 | 2025-12-26 | In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request. |
CVE-2025-68939 | High | 8.2 | 2025-12-26 | Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API. |
CVE-2025-68938 | Medium | 4.3 | 2025-12-26 | Gitea before 1.25.2 mishandles authorization for deletion of releases. |
CVE-2024-6886 | | 2024-08-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored X… | |
CVE-2022-38795 | Medium | 6.5 | 2023-08-07 | In Gitea through 1.17.1, repo cloning can occur in the migration function. |
CVE-2023-3515 | Medium | 4.4 | 2023-07-05 | Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. |
CVE-2022-46685 | Medium | 4.3 | 2022-12-12 | In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them th… |
CVE-2022-42968 | Critical | 9.8 | 2022-10-16 | Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled. |
CVE-2022-38183 | Medium | 6.5 | 2022-08-12 | In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to an… |
CVE-2022-1928 | Medium | 5.4 | 2022-05-29 | Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9. |
CVE-2022-30781 | High | 7.5 | 2022-05-16 | Gitea before 1.16.7 does not escape git fetch remote. |
CVE-2022-27313 | High | 7.5 | 2022-05-03 | An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file. |
CVE-2022-1058 | Medium | 6.1 | 2022-03-24 | Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. |
CVE-2021-29134 | Medium | 5.3 | 2022-03-15 | The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL. |
CVE-2022-0905 | High | 7.1 | 2022-03-10 | Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. |
CVE-2021-45331 | Critical | 9.8 | 2022-02-09 | An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA c… |
CVE-2021-45330 | Critical | 9.8 | 2022-02-09 | An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains… |
CVE-2021-45329 | Medium | 6.1 | 2022-02-08 | Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field. |
CVE-2021-45328 | Medium | 6.1 | 2022-02-08 | Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. |
CVE-2021-45327 | Critical | 9.8 | 2022-02-08 | Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a rem… |
CVE-2021-45326 | High | 8.8 | 2022-02-08 | Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests. |
CVE-2021-45325 | High | 7.5 | 2022-02-08 | Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL. |
CVE-2021-28378 | Low | 3.7 | 2021-03-15 | Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations. |
CVE-2021-3382 | High | 7.5 | 2021-02-05 | Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file pa… |
CVE-2020-28991 | Critical | 9.8 | 2020-11-24 | Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding)… |
CVE-2020-14144 | High | 7.2 | 2020-10-16 | The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not… |
CVE-2020-13246 | High | 7.5 | 2020-05-20 | An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization… |
CVE-2019-1010261 | Medium | 6.1 | 2019-07-18 | Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The compone… |
CVE-2019-1010314 | Medium | 6.1 | 2019-07-11 | Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded… |
CVE-2019-10330 | High | 7.5 | 2019-05-31 | Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles eve… |
CVE-2019-11576 | Critical | 9.8 | 2019-04-28 | Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the… |
CVE-2019-11229 | High | 8.8 | 2019-04-15 | models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution. |
CVE-2019-11228 | High | 7.5 | 2019-04-15 | repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. |
CVE-2019-1000002 | Medium | 6.5 | 2019-02-04 | Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting f… |
CVE-2018-18926 | Critical | 9.8 | 2018-11-04 | Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/ses… |
CVE-2018-1000803 | Medium | 5.3 | 2018-10-08 | Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be ex… |
CVE-2018-15192 | High | 8.6 | 2018-08-08 | An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. |