gitea.dev

44 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

44 results · Feed

Low 3.1

CVE-2026-23603

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go

Aug 13, 2026
Medium 6.5

CVE-2026-42931

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go

Aug 13, 2026
High 7.6

CVE-2026-34966

Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a cus…

Gitea Gitea code.gitea.io/gitea gitea.dev Go

Aug 5, 2026
High 7.1

CVE-2026-28740

Gitea LFS object reuse bypasses Code-unit authorization

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go

Jul 3, 2026