124832 matches found
CVE-2026-58443 Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches...
EUVD-2026-58170
Public-only repository tokens can update private PR head branches...
EUVD-2026-58165
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-58438
Gitea is vulnerable to a cross-repository IDOR (Insecure Direct Object Reference) within its issue-dependency removal functionality. The RemoveDependency function in routers/web/repo/issue_dependency.go retrieves issues using a global numeric ID via issues_model.GetIssueByID without performing an...
CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-58434 Private Repository Metadata Remains Accessible After Access Revocation
Private Repository Metadata Remains Accessible After Access Revocation...
CVE-2026-58434 Private Repository Metadata Remains Accessible After Access Revocation
Private Repository Metadata Remains Accessible After Access Revocation...
CVE-2026-58434
The Gitea application is vulnerable to an information disclosure flaw where private repository metadata remains accessible even after access revocation. While the specific root cause is not detailed in the provided documents, this issue allows for the exposure of sensitive information to unauthor...
EUVD-2026-58152
REST API exposes organization membership of private organizations to public...
CVE-2026-58417 REST API exposes organization membership of private organizations to public
REST API exposes organization membership of private organizations to public...
CVE-2026-58417 REST API exposes organization membership of private organizations to public
REST API exposes organization membership of private organizations to public...
CVE-2026-58417
The Gitea REST API contains an information disclosure vulnerability where it exposes organization membership of private organizations to the public. Specifically, the GET endpoint /orgs/{org}/public_members/{username} reveals whether a specific user belongs to a private organization, even though ...
CVE-2026-58416
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...