123 results · Feed
-
Medium 4.3
Gitea private repository metadata disclosure after access revocation
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository meta…
-
Critical 9.8
Gitea: Remote Code Execution via diffpatch Git Hook Installation
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
KEV Aug 25, 2026 -
High 8.1
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
-
Medium 4.3
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
-
Low 2.7
Webhook Authorization Header Returned in Plaintext via API
Webhook Authorization Header Returned in Plaintext via API
-
Medium 4.3
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
-
Medium 5.3
Private Repository Existence Disclosure via go-get Meta Endpoint
Private Repository Existence Disclosure via go-get Meta Endpoint
-
Low 2.7
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
-
Medium 4.3
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
-
Critical 9.1
Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches
-
Medium 6.5
Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass
-
Medium 6.3
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
-
High 8.1
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
-
High 7.5
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
-
High 7.1
Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options
-
High 7.5
Private Repository Metadata Remains Accessible After Access Revocation
Private Repository Metadata Remains Accessible After Access Revocation
-
Medium 5.4
Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation
-
Medium 5.9
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
-
Medium 6.5
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
-
Medium 4.9
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
-
Medium 4.3
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
-
High 7.7
Two SSRF findings in Gitea 1.26.2
Two SSRF findings in Gitea 1.26.2
-
Medium 6.5
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
-
High 8.5
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
-
Medium 5.9
Cross-repository issue/comment attachment re-linking can expose private attachment content
Cross-repository issue/comment attachment re-linking can expose private attachment content
-
Medium 6.2
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
-
Critical 9.1
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
-
Medium 6.2
Gitea SSH Key Parser Denial of Service
Gitea SSH Key Parser Denial of Service
-
High 8.1
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
-
Critical 9.6
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
-
Critical 9.8
Privilege Escalation via Access Token Scope Escalation in API
Privilege Escalation via Access Token Scope Escalation in API
-
Critical 9.1
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
-
Low 2.7
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
-
Medium 4.3
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
-
High 7.5
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
-
Low 3.1
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
-
Medium 6.5
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
-
High 7.6
Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass
Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a cus…
-
Medium —
Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions
### Summary The API endpoint used to fork repositories into organizations performs a weaker authorization check than the corresponding web UI and other repository creation endpoints. When a repository is forked into an organization through the API, the endpoi…
-
Critical 9.6
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write