67 matches found
BIT-GITEA-2026-79960 Gitea deploy key pushes acting as the repository owner
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-79960
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-79960 Gitea deploy key pushes acting as the repository owner
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-79960
The Gitea repository management platform contains a vulnerability where pushes authenticated with a deploy key are incorrectly recorded as being performed by the repository owner. This Incorrect Authorization (CWE-863) causes permission checks in the push hook pipeline to evaluate the owner's pri...
CVE-2026-79960 Gitea deploy key pushes acting as the repository owner
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-79960
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-79960 Gitea deploy key pushes acting as the repository owner
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
EUVD-2026-93918
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-79960
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-79960: Incorrect Authorization
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
PT-2026-107217
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description When a push is authenticated using a deploy key, the system incorrectly records the repository owner as the pusher. This causes permission checks in the push hook pipeline to evaluate the owner...
Malicious code in awk-sun-deploy-key-omega (npm)
Source: amazon-inspector 269eb7a813c15992670144ef18f9ce3cea7e0df757009a82a2b25dff93f3dd4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
ANT-2026-VN61PHA0 · gitea · IDOR
broken-authorization medium CVE-2026-58435 GHSA-rh79-75qm-gwjr Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-VN61PHA0: Git...
CVE-2026-58435
Gitea LFS Deploy-Key Privilege Escalation...
CVE-2026-58435
Gitea LFS Deploy-Key Privilege Escalation...
EUVD-2026-58162
Gitea LFS Deploy-Key Privilege Escalation...
CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation...
CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation...
CVE-2026-58435
Gitea's LFS server is vulnerable to a privilege escalation flaw due to a trust-boundary confusion in how it handles deploy keys . The system incorrectly sets the UserID in LFS JWT tokens to the repository owner's ID rather than the specific deploy key's identity. Consequently, an attacker possess...