EUVD-2026-41606

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories...

GHSA-3PWW-VCVM-3GMJ Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Summary A Gitea personal access token PAT restricted to a non-repository scope e.g. read:issue can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied 403 on /raw, /media, /archive, and the...

EUVD-2026-41634

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data...

GHSA-2M9V-5Q2G-58VQ Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be...

EUVD-2026-41643

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects...

CVE-2026-65054

Affected software: MediaCMS 8.2.0. Vulnerability: Information disclosure via playlist ownership loophole. Authenticated users can expose private media metadata belonging to other users by bypassing access controls when manipulating their own playlists. Root cause / trigger: Attacker issues a PUT ...

CVE-2026-65054 MediaCMS Private Media Metadata Disclosure via Playlist Ownership Loophole

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary media tokens to their own playlist without access control checks. Attackers can issue a PUT request to the playlist API...

GHSA-QF2F-QH6P-7V89 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo access at output time: - GET /api/v1/user/starred — getStarredRepos computes a per-repo...

Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo access at output time: - GET /api/v1/user/starred — getStarredRepos computes a per-repo...

GHSA-66M4-5JJR-2RG5 Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Affected product Gitea — services/repository/collaboration.go DeleteCollaboration + webhook delivery Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup...

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Affected product Gitea — services/repository/collaboration.go DeleteCollaboration + webhook delivery Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup...

CVE-2025-68640

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET Private Endpoint Token to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in...

EUVD-2026-46270

Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the ninja-forms/submissions-table Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated...

CVE-2026-64131

A flaw was found in the Linux kernel's memory management subsystem. The unmapping process for device-private and exclusive memory pages incorrectly checks if a virtual memory area VMA is anonymous. This can lead to spurious warnings during process teardown when a folio is part of a private...

PT-2026-63316

Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo access at output time: - GET /api/v1/user/starred — getStarredRepos computes a per-repo...

CVE-2025-68640

CVE-2025-68640 affects Apple's Find My backend service (through 2025-12-17). With a valid Private Endpoint Token (PET), an attacker can enumerate devices linked to an Apple ID and remove offline devices without triggering two‑factor authentication or ownership verification, potentially leading to...

PT-2026-63309

Summary A personal access token PAT or OAuth2 token that does not carry the repository scope or that is public-only is correctly rejected HTTP 403 by the recently hardened web content routes archive download, raw/media file download, and repository RSS/Atom feeds. However, the repository home pag...

PT-2026-63306

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.4 Description A flaw exists where webhooks created by a collaborator with admin permissions on a private repository continue to trigger after the collaborator's access has been revoked. The DeleteCollaboration function in...

PT-2026-63291

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description A confidentiality breach exists where an attacker-controlled fork pull-request workflow can gain read access to a third private repository. This occurs because the GetActionsUserRepoPermission function in...

PT-2026-63277

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description RSS and Atom feed handlers fail to enforce token-scope or public-only restrictions when using API-token Basic authentication. This allows a personal access token that is restricted to public-only access or lack...