CVE-2025-68944

Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries...

CVE-2025-68945

In Gitea before 1.21.2, an anonymous user can visit a private user's project...

CVE-2025-68946

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS...

CVE-2025-68946

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS...

CVE-2025-68946

CVE-2025-68946 affects Gitea releases before 1.20.1, where a link can specify a forbidden URL scheme (e.g., javascript:) enabling XSS. The issue is fixed by upgrading to Gitea 1.20.1 or later (patch/markup module remediation noted in the linked advisories/releases). Practical impact is Cross‑Site...

EUVD-2025-205421

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS...

CVE-2025-68946

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS...

CVE-2025-68945

The CVE-2025-68945 issue affects Gitea prior to 1.21.2, where an anonymous user could visit a private user’s project, potentially exposing project details. Connected advisories (OSV entries and vendor/go-sources) confirm the vulnerability in Gitea’s routing layers (e.g., routers/api/v1 and router...

EUVD-2025-205424

In Gitea before 1.21.2, an anonymous user can visit a private user's project...

CVE-2025-68945

In Gitea before 1.21.2, an anonymous user can visit a private user's project...

CVE-2025-68945

In Gitea before 1.21.2, an anonymous user can visit a private user's project...

CVE-2025-68945

In Gitea before 1.21.2, an anonymous user can visit a private user's project...

CVE-2025-68944

Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries...

CVE-2025-68944

Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries...

CVE-2025-68944

CVE-2025-68944 affects Gitea before 1.22.2, where token scope propagation in one of Gitea’s package registries can bypass access controls. The OSV and related advisories describe exploitation as an Incorrect Authorization due to improper handling of token scopes in package registries (e.g., conta...

EUVD-2025-205415

Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries...

CVE-2025-68944

Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries...

Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text

Gitea before 1.22.2 allows XSS because the search input box for creating tags and branches is v-html instead of v-text...

GHSA-898P-HH3P-HF9R Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text

Gitea before 1.22.2 allows XSS because the search input box for creating tags and branches is v-html instead of v-text...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to mishandling access control to private resources. An attacker can gain unauthorized access to private resources by using an API token that is restricted to public resources. Remediation Upgrade...