github.com/go-gitea/gitea

9 results · Clear filters · Feed

• Medium 6.1
  CVE-2026-25779

  Gitea redirect handling permits open redirects through backslash paths

  Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.

  Gitea Gitea Open Source Git Server code.gitea.io/gitea github.com/go-gitea/gitea Go
  Jul 3, 2026
• Medium 4.3
  CVE-2026-20888

  Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)

  Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users.

  Gitea Gitea Open Source Git Server code.gitea.io/gitea github.com/go-gitea/gitea Go
  Jan 22, 2026
• Medium 6.5
  CVE-2026-20904

  Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes

  Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

  Gitea Gitea Open Source Git Server code.gitea.io/gitea github.com/go-gitea/gitea Go
  Jan 22, 2026
• Medium 6.5
  CVE-2026-20800

  Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation

  Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notificati…

  Gitea Gitea Open Source Git Server code.gitea.io/gitea github.com/go-gitea/gitea Go
  Jan 22, 2026
• Medium 6.5
  CVE-2026-20883

  Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure

  Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.

  Gitea Gitea Open Source Git Server code.gitea.io/gitea github.com/go-gitea/gitea Go
  Jan 22, 2026
• Medium 6.1
  CVE-2021-45329

  Cross-site Scripting in Gitea

  Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.

  github.com/go-gitea/gitea gitea golang-code.gitea-git golang-code.gitea-sdk Ubuntu Alpine Go
  Feb 8, 2022
• Medium 6.1
  CVE-2021-45328

  Open redirect in Gitea

  Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.

  github.com/go-gitea/gitea golang-code.gitea-git golang-code.gitea-sdk Ubuntu Go
  Feb 8, 2022
• Medium 5.3
  CVE-2021-45325

  Gitea displaying raw OpenID error in UI

  Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.

  github.com/go-gitea/gitea golang-code.gitea-git golang-code.gitea-sdk Ubuntu Go
  Feb 8, 2022
• Medium 5.3
  CVE-2018-1000803

  Gitea Exposes Private Email Addresses

  Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other r…

  github.com/go-gitea/gitea Go
  Oct 8, 2018