Skip to content
OpenAdvisories
High WID-SEC-2026-4281 18 CVEs

Gitea: Mehrere Schwachstellen

Published Nov 1, 2026 · Updated Nov 1, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.

Product

Gitea ist ein quelloffener Github-Klon.

Vulnerabilities 18

  • Critical 9.1
    CVE-2026-116289

    Gitea public-only token bypass through Actions runner registration

    Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only …

    Gitea Gitea
  • Critical 9.1
    CVE-2026-117685

    Gitea public-only package token access to private OCI blobs

    The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but checked the source blob only against the full account permissions of the token owner. A `public-only` token with `write:package` scope…

    Gitea Gitea
  • High 7.5
    CVE-2026-118395

    Gitea public-only token bypass in repository and organization creation

    Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POS…

    Gitea Gitea
  • High 7.5
    CVE-2026-119441

    Gitea public-only token bypass on bulk organization repository deletion

    `DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public org…

    Gitea Gitea
  • High 7.5
    CVE-2026-119533

    Gitea private pull request disclosure on project boards

    Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the …

    Gitea Gitea
  • Medium 6.5
    CVE-2026-116296 Public exploit

    Gitea archived repository release, milestone and label modification

    The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release…

    Gitea Gitea
  • Medium 6.5
    CVE-2026-116474

    Gitea Actions job token spoofing of instance-signed commits

    The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation…

    Gitea Gitea
  • Medium 6.5
    CVE-2026-117635 Public exploit

    Gitea admin API public-only token scope bypass

    The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, creat…

    Gitea Gitea
  • Medium 6.5
    CVE-2026-117677

    Gitea Helm chart upload decompression denial of service

    When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed u…

    Gitea Gitea
  • Medium 6.5
    CVE-2026-118504

    Gitea issue changes on archived repositories through the API

    The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whether the repository is archived. A user allowed to change issues of an archived repository could use the API to edit, c…

    Gitea Gitea
  • Medium 5.4
    CVE-2026-113429

    Gitea stored XSS through legacy Actions artifact Content-Encoding

    Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that is served as the artifact's `Content-Type` on download, and a value starting with `video/` or `audio/` also removed the sandboxing Content-S…

    Gitea Gitea
  • Medium 5.3
    CVE-2026-114199

    Gitea contribution heatmap private activity disclosure to public-only tokens

    `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token coul…

    Gitea Gitea
  • Medium 4.3
    CVE-2026-112887

    Gitea Actions task token private repository enumeration

    Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped route…

    Gitea Gitea
  • Medium 4.3
    CVE-2026-117646

    Gitea private repository listing to public-only tokens on profiles

    The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public reso…

    Gitea Gitea
  • Medium 4.3
    CVE-2026-118394

    Gitea OAuth2 userinfo private group disclosure to public-only tokens

    The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the r…

    Gitea Gitea
  • Medium 4.3
    CVE-2026-119625

    Gitea user and organization feed token scope bypass

    The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and t…

    Gitea Gitea
  • Medium 4.3
    CVE-2026-119627

    Gitea limited-visibility profile disclosure with public-only tokens

    The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user hol…

    Gitea Gitea
  • Low 3.5
    CVE-2026-117649

    Gitea private issue disclosure through issue dependency timeline events

    The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependency removed" events. When a readable issue had been linked as a dependency to an issue in a reposito…

    Gitea Gitea

Revision history

  1. #1

    Initiale Fassung

References