Skip to content
OpenAdvisories

Vendor

Gitea

210 known vulnerabilities.

Products

Gitea 111 Gitea Open Source Git Server 97 Gitea Runner 1 act_runner 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Low 3.5
    CVE-2026-117649

    Gitea private issue disclosure through issue dependency timeline events

    The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependency removed" events. When a readable issue had been linked as a dependency to an issue in a reposito…

    Gitea Gitea
  • Low 3.1
    CVE-2026-97204

    Gitea label deletion across repository and organization IDs

    Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization…

    Gitea Gitea
  • Low 3.5
    CVE-2026-60008

    Gitea Jupyter notebook UI redress through CSS class injection

    Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply mult…

    Gitea Gitea
  • Low 2.7
    CVE-2026-58511

    Webhook Authorization Header Returned in Plaintext via API

    Webhook Authorization Header Returned in Plaintext via API

    Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go
  • Low 2.7
    CVE-2026-58445

    Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

    Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

    Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go
  • Low 2.7
    CVE-2026-55984

    Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

    Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

    Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go
  • Low 3.1
    CVE-2026-23603

    Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

    Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

    Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go
  • Low 3.5
    CVE-2026-0798

    Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation

    Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potenti…

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • Low 3.1
    CVE-2025-68940

    Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.

    In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.

    Gitea Gitea code.gitea.io/gitea Go