Skip to content
OpenAdvisories
High WID-SEC-2026-2027 8 CVEs

Gitea: Mehrere Schwachstellen

Published Jun 21, 2026 · Updated Aug 12, 2026 · Revision 3 · de-DE

Vendor: SUSE Product: openSUSE Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um erweiterte Berechtigungen zu erlangen, sich als Benutzer auszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

Gitea ist ein quelloffener Github-Klon.

Vulnerabilities 8

  • Critical 9.8
    CVE-2026-20896 Public exploit Scanner template

    Gitea Docker image trusts spoofable reverse-proxy headers by default

    Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • Critical 9.6
    CVE-2026-22874 Public exploit

    Gitea webhook and migration allow-list filtering permits SSRF

    Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • High 8.8
    CVE-2026-27775

    Gitea pre-receive hook permission cache allows full repository write access

    Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • High 7.5
    CVE-2026-24451

    Gitea fork synchronization can expose private parent repository data

    Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • High 7.5
    CVE-2026-25038

    Gitea private organization labels are visible to unauthorized users

    Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • High 7.1
    CVE-2026-20779

    Gitea TOTP single-use enforcement defect allows OTP replay

    Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • High 7.1
    CVE-2026-28740

    Gitea LFS object reuse bypasses Code-unit authorization

    Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go
  • Medium 4.3
    CVE-2026-27761

    Gitea repository feeds bypass API token scope enforcement

    Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go

Revision history

  1. #3

    Neue Updates von openSUSE aufgenommen

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-41636, EUVD-2026-41634, EUVD-2026-41621, EUVD-2026-41618, EUVD-2026-41619, EUVD-2026-41614, EUVD-2026-41643, EUVD-2026-41613

  3. #1

    Initiale Fassung

References