Skip to content
OpenAdvisories

Vendor

Gitea

210 known vulnerabilities.

Products

Gitea 111 Gitea Open Source Git Server 97 Gitea Runner 1 act_runner 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-116296 Public exploit

    Gitea archived repository release, milestone and label modification

    The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release…

    Gitea Gitea
  • Medium 6.5
    CVE-2026-97859 Public exploit

    Gitea API disclosure of private user social graph, keys and stars

    Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target user. An a…

    Gitea Gitea
  • Medium 4.3
    CVE-2026-110311 Public exploit

    Gitea draft release creation disclosing attachment metadata

    Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the met…

    Gitea Gitea