Summary
Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.
Product
Gitea ist ein quelloffener Github-Klon.
Vulnerabilities 46
-
Critical 9.8
Privilege Escalation via Access Token Scope Escalation in API
Privilege Escalation via Access Token Scope Escalation in API
-
Critical 9.6
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
-
Critical 9.1
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
-
Critical 9.1
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
-
Critical 9.1
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
-
Critical 9.1
Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches
-
Critical 9.1
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
-
High 8.5
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
-
High 8.1
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
-
High 8.1
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
-
High 7.7
Two SSRF findings in Gitea 1.26.2
Two SSRF findings in Gitea 1.26.2
-
High 7.5
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
-
High 7.5
REST API exposes organization membership of private organizations to public
REST API exposes organization membership of private organizations to public
-
High 7.5
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
-
High 7.5
Private Repository Metadata Remains Accessible After Access Revocation
Private Repository Metadata Remains Accessible After Access Revocation
-
High 7.5
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
-
High 7.5
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
-
High 7.5
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
-
High 7.1
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
-
High 7.1
Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options
-
Medium 6.8
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
-
Medium 6.5
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
-
Medium 6.5
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
-
Medium 6.5
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
-
Medium 6.5
Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass
-
Medium 6.3
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
-
Medium 6.2
Gitea SSH Key Parser Denial of Service
Gitea SSH Key Parser Denial of Service
-
Medium 6.2
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
-
Medium 5.9
Cross-repository issue/comment attachment re-linking can expose private attachment content
Cross-repository issue/comment attachment re-linking can expose private attachment content
-
Medium 5.9
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
-
Medium 5.4
Email Management API Bypasses ManageCredentials Feature Restrictions
Email Management API Bypasses ManageCredentials Feature Restrictions
-
Medium 5.4
Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation
-
Medium 5.3
Private Repository Existence Disclosure via go-get Meta Endpoint
Private Repository Existence Disclosure via go-get Meta Endpoint
-
Medium 4.9
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
-
Medium 4.4
Local File Inclusion via file:// URI in Migration Restore
Local File Inclusion via file:// URI in Migration Restore
-
Medium 4.3
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
-
Medium 4.3
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
-
Medium 4.3
Public-only API token restriction is not enforced on team API routes
Public-only API token restriction is not enforced on team API routes
-
Medium 4.3
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
-
Medium 4.3
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
-
Medium 4.3
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
-
Medium 4.3
Gitea private repository metadata disclosure after access revocation
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository meta…
-
Low 3.1
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
-
Low 2.7
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
-
Low 2.7
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
-
Low 2.7
Webhook Authorization Header Returned in Plaintext via API
Webhook Authorization Header Returned in Plaintext via API
Revision history
-
#4
Referenz(en) aufgenommen: CVE-2026-59766, EUVD-2026-101280
-
#3
Referenz(en) aufgenommen: EUVD-2026-58168, EUVD-2026-58166, EUVD-2026-58167, EUVD-2026-58165, EUVD-2026-58164, EUVD-2026-58163, EUVD-2026-58162, EUVD-2026-58161, EUVD-2026-58160, EUVD-2026-58149, EUVD-2026-58148, EUVD-2026-58147, EUVD-2026-58146, EUVD-2026-58145, EUVD-2026-58144, EUVD-2026-58143, EUVD-2026-58141, EUVD-2026-58139, EUVD-2026-58138, EUVD-2026-58137, EUVD-2026-58136, EUVD-2026-58135, EUVD-2026-58134, EUVD-2026-58126, EUVD-2026-58125, EUVD-2026-58124, EUVD-2026-58123, EUVD-2026-58169, EUVD-2026-58174, EUVD-2026-58173, EUVD-2026-58172, EUVD-2026-58171, EUVD-2026-58170, EUVD-2026-58159, EUVD-2026-58158, EUVD-2026-58157, EUVD-2026-58155, EUVD-2026-58154, EUVD-2026-58153, EUVD-2026-58152, EUVD-2026-58150, EUVD-2026-58151, EUVD-2026-58140
-
#2
Neue Updates von openSUSE aufgenommen
-
#1
Initiale Fassung
References
-
Gitea 1.27.0 Release vom 2026-07-13
https://github.com/go-gitea/gitea/releases/tag/v1.27.0
-
GitHub Security Advisory GHSA-25gq-j9jx-43pg vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-25gq-j9jx-43pg
-
GitHub Security Advisory GHSA-2fcr-jfvc-vgg2 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-2fcr-jfvc-vgg2
-
GitHub Security Advisory GHSA-46c7-w5w4-h644 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-46c7-w5w4-h644
-
GitHub Security Advisory GHSA-5ggr-2f2h-jmvm vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-5ggr-2f2h-jmvm
-
GitHub Security Advisory GHSA-66m4-5jjr-2rg5 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5
-
GitHub Security Advisory GHSA-683j-3ff6-hh2x vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-683j-3ff6-hh2x
-
GitHub Security Advisory GHSA-6cqf-375w-639g vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-6cqf-375w-639g
-
GitHub Security Advisory GHSA-6hm7-3pwj-22rm vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-6hm7-3pwj-22rm
-
GitHub Security Advisory GHSA-82f7-87hm-852x vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-82f7-87hm-852x
-
GitHub Security Advisory GHSA-8p9h-49rc-qgxj vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-8p9h-49rc-qgxj
-
GitHub Security Advisory GHSA-94v3-77j7-vm48 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-94v3-77j7-vm48
-
GitHub Security Advisory GHSA-9mq6-mqjj-c2c5 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5
-
GitHub Security Advisory GHSA-cp3q-vrj2-ghhh vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-cp3q-vrj2-ghhh
-
GitHub Security Advisory GHSA-fj8v-hjwv-qm88 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-fj8v-hjwv-qm88
-
GitHub Security Advisory GHSA-fq2p-5p22-8g6j vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-fq2p-5p22-8g6j
-
GitHub Security Advisory GHSA-fw57-jgch-pgf3 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-fw57-jgch-pgf3
-
GitHub Security Advisory GHSA-h2x6-g7q6-344v vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-h2x6-g7q6-344v
-
GitHub Security Advisory GHSA-h56g-4qw7-2mxg vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-h56g-4qw7-2mxg
-
GitHub Security Advisory GHSA-j2w3-9c3r-g83q vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-j2w3-9c3r-g83q
-
GitHub Security Advisory GHSA-j72v-mjr6-3424 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-j72v-mjr6-3424
-
GitHub Security Advisory GHSA-jr5x-6h83-wrxf vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-jr5x-6h83-wrxf
-
GitHub Security Advisory GHSA-m6qc-j894-7h9r vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-m6qc-j894-7h9r
-
GitHub Security Advisory GHSA-m932-crvm-gcp5 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-m932-crvm-gcp5
-
GitHub Security Advisory GHSA-mg4f-x9v4-6h2p vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-mg4f-x9v4-6h2p
-
GitHub Security Advisory GHSA-pgqf-926r-548m vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-pgqf-926r-548m
-
GitHub Security Advisory GHSA-prr9-9mp4-5gp2 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-prr9-9mp4-5gp2
-
GitHub Security Advisory GHSA-q9pg-jj6x-j9p6 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-q9pg-jj6x-j9p6
-
GitHub Security Advisory GHSA-qf2f-qh6p-7v89 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-qf2f-qh6p-7v89
-
GitHub Security Advisory GHSA-rgv6-xp99-6mgj vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-rgv6-xp99-6mgj
-
GitHub Security Advisory GHSA-rh79-75qm-gwjr vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-rh79-75qm-gwjr
-
GitHub Security Advisory GHSA-vrhc-jjfc-m3m3 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-vrhc-jjfc-m3m3
-
GitHub Security Advisory GHSA-vxv2-8j6r-pcpg vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-vxv2-8j6r-pcpg
-
GitHub Security Advisory GHSA-w5pg-649r-p6gg vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-w5pg-649r-p6gg
-
GitHub Security Advisory GHSA-wwqq-x6w4-frm2 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-wwqq-x6w4-frm2
-
GitHub Security Advisory GHSA-x77v-q46j-393g vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-x77v-q46j-393g
-
GitHub Security Advisory GHSA-xmj7-xj85-hfc3 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-xmj7-xj85-hfc3
-
GitHub Security Advisory GHSA-xv9x-fj9g-vj6h vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-xv9x-fj9g-vj6h
-
GitHub Security Advisory GHSA-xxjv-752h-3vp2 vom 2026-07-13
https://github.com/go-gitea/gitea/security/advisories/GHSA-xxjv-752h-3vp2
-
openSUSE Security Update OPENSUSE-SU-2026:21551-1 vom 2026-08-12
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U3Y5I25TBZPPWBQLNS6WIFTXT7XXYJ7A/