48 results · Clear filters · Feed
-
Medium 4.3
Gitea private repository metadata disclosure after access revocation
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository meta…
-
Medium 4.3
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
-
Medium 4.3
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
-
Medium 5.3
Private Repository Existence Disclosure via go-get Meta Endpoint
Private Repository Existence Disclosure via go-get Meta Endpoint
-
Medium 4.3
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
-
Medium 6.5
Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass
-
Medium 6.3
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
-
Medium 5.4
Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation
-
Medium 5.9
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
-
Medium 6.5
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
-
Medium 4.9
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
-
Medium 4.3
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
-
Medium 6.5
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
-
Medium 5.9
Cross-repository issue/comment attachment re-linking can expose private attachment content
Cross-repository issue/comment attachment re-linking can expose private attachment content
-
Medium 6.2
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
-
Medium 6.2
Gitea SSH Key Parser Denial of Service
Gitea SSH Key Parser Denial of Service
-
Medium 4.3
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
-
Medium 6.5
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
-
Medium —
Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions
### Summary The API endpoint used to fork repositories into organizations performs a weaker authorization check than the corresponding web UI and other repository creation endpoints. When a repository is forked into an organization through the API, the endpoi…
-
Medium 6.5
SSRF via HTTP Redirect in Repository Migration
SSRF via HTTP Redirect in Repository Migration
-
Medium 5.3
Gitea repository dumps write release assets using unsafe path names
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.
-
Medium 4.3
Gitea issue-template APIs bypass repository unit authorization
Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.
-
Medium 4.3
Gitea repository feeds bypass API token scope enforcement
Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.
-
Medium 6.1
Gitea redirect handling permits open redirects through backslash paths
Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.
-
Medium 5.3
Gitea tracked-time deletion can target entries from another issue
Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.
-
Medium 4.3
Gitea user organization API bypasses public-only token filtering
Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.
-
Medium 5.3
Gitea tracked-time list endpoint has insufficient permission checks
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.
-
Medium —
Gitea has insecure default SSH settings
## Summary The built-in SSH server currently advertises a number of key exchange, MAC, and host key algorithms that are considered weak or broken. The defaults should be tightened so a fresh installation passes a baseline SSH security audit out of the box. ##…
-
Medium 4.3
Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users.
-
Medium 6.5
Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.
-
Medium 6.5
Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notificati…
-
Medium 6.5
Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.
-
Medium 5.3
Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
-
Medium 5.4
Gitea vulnerable to Cross-site Scripting
In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
-
Medium 5.8
Gitea: anonymous user can visit private user's project
In Gitea before 1.21.2, an anonymous user can visit a private user's project.
-
Medium 5.0
Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries
Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
-
Medium 5.3
Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order
Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.
-
Medium 5.4
Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text
Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.
-
Medium 4.9
Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources
Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.
-
Medium 4.3
Gitea mishandles authorization for deletion of releases
Gitea before 1.25.2 mishandles authorization for deletion of releases.