Skip to content
OpenAdvisories
Medium WID-SEC-2026-4021 7 CVEs

Gitea: Mehrere Schwachstellen

Published Oct 18, 2026 · Updated Oct 18, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.

Product

Gitea ist ein quelloffener Github-Klon.

Vulnerabilities 7

  • Medium 6.5
    CVE-2026-110324

    Gitea private profile information disclosure through POST request

    The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a us…

    Gitea Gitea
  • Medium 6.5
    CVE-2026-97859 Public exploit

    Gitea API disclosure of private user social graph, keys and stars

    Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target user. An a…

    Gitea Gitea
  • Medium 6.3
    CVE-2026-110494

    Gitea release attachment re-linking of issue attachments

    Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, …

    Gitea Gitea
  • Medium 4.3
    CVE-2026-107686

    Gitea reactions accepted on locked issues and comments

    The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked iss…

    Gitea Gitea
  • Medium 4.3
    CVE-2026-109844

    Gitea watched repositories API disclosure after access revocation

    `GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team pe…

    Gitea Gitea
  • Medium 4.3
    CVE-2026-110311 Public exploit

    Gitea draft release creation disclosing attachment metadata

    Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the met…

    Gitea Gitea
  • Low 3.1
    CVE-2026-97204

    Gitea label deletion across repository and organization IDs

    Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization…

    Gitea Gitea

Revision history

  1. #1

    Initiale Fassung

References