High WID-SEC-2026-2149 7 CVEs

Gitea: Mehrere Schwachstellen

Published Jun 30, 2026 · Updated Aug 12, 2026 · Revision 3 · de-DE

Vendor: SUSE Product: openSUSE Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Gitea ist ein quelloffener Github-Klon.

Vulnerabilities 7

Critical 9.8

CVE-2026-58422

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Gitea Gitea Open Source Git Server code.gitea.io/gitea Go

Jul 3, 2026
Critical 9.6

CVE-2026-58426

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea Gitea Open Source Git Server code.gitea.io/gitea Go

Jul 3, 2026
High 8.9

CVE-2026-58424 Public exploit

Permanent Fork PR Workflow Approval Gate Bypass

Permanent Fork PR Workflow Approval Gate Bypass

Gitea Gitea Open Source Git Server code.gitea.io/gitea Go

Jul 3, 2026
High 7.7

CVE-2026-58423

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Gitea Gitea Open Source Git Server code.gitea.io/gitea Go

Jul 3, 2026
High 7.5

CVE-2026-58419

Notification API leaks private issue metadata after access revocation

Notification API leaks private issue metadata after access revocation

Gitea Gitea Open Source Git Server code.gitea.io/gitea Go

Jul 3, 2026
High 7.5

CVE-2026-58421

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Gitea Gitea Open Source Git Server code.gitea.io/gitea Go

Jul 3, 2026
Medium 6.5

CVE-2026-58418

SSRF via HTTP Redirect in Repository Migration

SSRF via HTTP Redirect in Repository Migration

Gitea Gitea Open Source Git Server code.gitea.io/gitea Go

Jul 3, 2026

Revision history

2026-08-12 #3
Neue Updates von openSUSE aufgenommen
2026-07-05 #2
Referenz(en) aufgenommen: EUVD-2026-41608, EUVD-2026-41605, EUVD-2026-41606, EUVD-2026-41602, EUVD-2026-41603, EUVD-2026-41604, EUVD-2026-41607
2026-06-30 #1
Initiale Fassung

References

GitHub Security Advisory GHSA-v96j-25gv-g2w9 vom 2026-06-30
https://github.com/go-gitea/gitea/security/advisories/GHSA-v96j-25gv-g2w9
GitHub Security Advisory GHSA-rqhx-647v-wx32 vom 2026-06-30
https://github.com/go-gitea/gitea/security/advisories/GHSA-rqhx-647v-wx32
GitHub Security Advisory GHSA-hg5r-vq93-9fv6 vom 2026-06-30
https://github.com/go-gitea/gitea/security/advisories/GHSA-hg5r-vq93-9fv6
GitHub Security Advisory GHSA-g9g6-qhrc-p3qc vom 2026-06-30
https://github.com/go-gitea/gitea/security/advisories/GHSA-g9g6-qhrc-p3qc
GitHub Security Advisory GHSA-7wvc-rvp7-w99x vom 2026-06-30
https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x
GitHub Security Advisory GHSA-777r-4v59-6486 vom 2026-06-30
https://github.com/go-gitea/gitea/security/advisories/GHSA-777r-4v59-6486
GitHub Security Advisory GHSA-44qc-pgvp-wx7v vom 2026-06-30
https://github.com/go-gitea/gitea/security/advisories/GHSA-44qc-pgvp-wx7v
openSUSE Security Update OPENSUSE-SU-2026:21551-1 vom 2026-08-12
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U3Y5I25TBZPPWBQLNS6WIFTXT7XXYJ7A/