Skip to content
OpenAdvisories
Medium WID-SEC-2026-1172 3 CVEs

Gitea: Mehrere Schwachstellen

Published Apr 19, 2026 · Updated Jul 5, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

Gitea ist ein quelloffener Github-Klon.

Vulnerabilities 3

  • Critical 9.8
    CVE-2026-27780

    Gitea pre-receive hook can miss branch-protection checks after scanner errors

    Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • High 8.7
    CVE-2026-28737

    Gitea 3D file viewer allows stored XSS through glTF extensionsRequired

    Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • High 8.1
    CVE-2026-22555

    Gitea organization forks can expose organization secrets without create permission

    Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-41638, EUVD-2026-41642, EUVD-2026-41617

  2. #1

    Initiale Fassung

References