CVE-2026-78231 Gitea blind SSRF through OpenID assertion verification

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services...

CVE-2026-78231

The software Gitea is vulnerable to a blind Server-Side Request Forgery (SSRF) when OpenID sign-in is enabled. The root cause is that Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to a caller-supplied OpenID provider endpoint during verification. An attacker ...

EUVD-2026-101110

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services...

CVE-2026-73814

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to...

CVE-2026-73814 Gitea repository ownership escalation by administrators

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to...

EUVD-2026-101109

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to...

CVE-2026-73814 Gitea repository ownership escalation by administrators

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to...

CVE-2026-73814

The Gitea software contains a privilege escalation vulnerability in the collaboration access-mode endpoint . An authenticated repository collaborator with Admin access can exploit this flaw to promote their permissions to Owner . Once elevated, the attacker can perform owner-only operations, such...

CVE-2026-73814

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to...

CVE-2026-73814 Gitea repository ownership escalation by administrators

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to...

CVE-2026-73539

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On...

CVE-2026-73539 Gitea external renderer argument injection and code execution

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On...

EUVD-2026-101105

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On...

CVE-2026-73539 Gitea external renderer argument injection and code execution

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On...

CVE-2026-73539 Gitea external renderer argument injection and code execution

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On...

CVE-2026-73539

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On...

CVE-2026-73539

Gitea is vulnerable to argument injection due to improper neutralization of argument delimiters in command templates. The software substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument split...

CVE-2026-73273

Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This...

CVE-2026-73273

Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This...

CVE-2026-73273 Gitea Maven checksum upload quota bypass and memory exhaustion

Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This...