Skip to content
OpenAdvisories
High WID-SEC-2026-2863 7 CVEs

Gitea: Mehrere Schwachstellen

Published Aug 16, 2026 · Updated Oct 14, 2026 · Revision 3 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Berechtigungen zu erweitern, Benutzerkonten zu übernehmen, vertrauliche Informationen offenzulegen oder beliebigen Code als Gitea-Dienstbenutzer auszuführen.

Product

Gitea ist ein quelloffener Github-Klon.

Vulnerabilities 7

  • Critical 9.8
    CVE-2026-73278

    Gitea WebAuthn bypass during OAuth and OIDC sign-in

    Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the pa…

    Gitea Gitea
  • High 8.8
    CVE-2026-73535

    Gitea second-factor bypass through OpenID identity linking

    Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtai…

    Gitea Gitea
  • High 8.8
    CVE-2026-73800

    Gitea reusable workflow secret exposure in pull_request_target

    Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository a…

    Gitea Gitea
  • High 8.1
    CVE-2026-73804

    Gitea API token scope escalation through HTTP signatures

    Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope infor…

    Gitea Gitea
  • High 7.5
    CVE-2026-73539

    Gitea external renderer argument injection and code execution

    Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options tha…

    Gitea Gitea
  • Medium 6.5
    CVE-2026-73814

    Gitea repository ownership escalation by administrators

    Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, incl…

    Gitea Gitea
  • Low 3.5
    CVE-2026-60008

    Gitea Jupyter notebook UI redress through CSS class injection

    Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply mult…

    Gitea Gitea

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-101106, EUVD-2026-101109, EUVD-2026-101108, EUVD-2026-101105, EUVD-2026-101104, EUVD-2026-101282

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-93940

  3. #1

    Initiale Fassung

References