Vendor
Gitea
210 known vulnerabilities.
210 results · Feed
-
High 8.1
Gitea installer authentication bypass for existing accounts
When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated ses…
-
Medium 4.3
Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS
With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as `169.254.169.254`, even when `ALLOW_LOCALNETWORKS = false`. The local-netw…
-
High 7.5
Gitea denial of service through external issue tracker patterns
A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repositor…
-
Medium 6.5
Gitea issue reference parsing CPU exhaustion
When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment…
-
Critical 9.8
Gitea fork workflow approval bypass through maintainer-triggered events
Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run …
-
High 7.1
Gitea deploy key pushes acting as the repository owner
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags wit…
-
High 7.5
Gitea repository migration SSRF through DNS rebinding
Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS …
-
High 7.5
Gitea SSRF through Git HTTP redirects in mirrors and fetches
Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a pol…
-
High 8.1
Gitea API team demotion not applied to unit permissions
Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to rea…
-
Critical 9.1
Gitea review and execution mismatch through duplicate tree entries
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contribu…
-
High 8.1
Gitea push mirror SSRF and forced writes to internal Git hosts
Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a blocked or internal add…
-
High 7.5
Gitea trusted workflow cancellation by unapproved fork runs
When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can ope…
-
Medium 5.4
Gitea container registry stored XSS through blob media type
Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or restrictive content security policy. A user who can push container images can publish a blo…
-
Medium 4.3
Gitea migration and pull mirror SSRF through multi-answer DNS
Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create…
-
High 7.7
Gitea migration SSRF through ALLOWED_DOMAINS address check bypass
When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed host…
-
High 8.8
Gitea fork workflow job revival through later approval
A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marke…
-
Critical 9.1
Gitea built-in SSH server authentication bypass through key case folding
When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who ca…
-
High 8.8
Gitea fork workflow approval bypass through cancel and rerun
Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so …
-
Critical 9.8
Gitea: Remote Code Execution via diffpatch Git Hook Installation
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
KEV Aug 25, 2026 -
High 8.1
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
-
Medium 6.5
Gitea runner registration-token GET endpoint performs a write under a read-only token scope
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A h…
-
High 7.5
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
-
Medium 4.3
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
-
Low 2.7
Webhook Authorization Header Returned in Plaintext via API
Webhook Authorization Header Returned in Plaintext via API
-
Medium 4.3
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
-
Critical 9.1
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
-
Medium 5.3
Private Repository Existence Disclosure via go-get Meta Endpoint
Private Repository Existence Disclosure via go-get Meta Endpoint
-
Low 2.7
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
-
Medium 4.3
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
-
Critical 9.1
Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches
-
Medium 6.5
Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass
-
Medium 6.3
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
-
Medium 6.8
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
-
High 7.5
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
-
High 8.1
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
-
High 7.5
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
-
High 7.1
Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options
-
High 7.5
Private Repository Metadata Remains Accessible After Access Revocation
Private Repository Metadata Remains Accessible After Access Revocation
-
Medium 5.4
Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation
-
Critical 9.1
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting