ROS-20260813-73-0014

The vulnerability in Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability can allow an attacker to cause service failures...

ROS-20260813-73-0043

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260813-73-0030

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260813-73-0037

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

SUSE CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

...[ More ]

A proof of concept exploit for a server-side request forgery vulnerability in Gitea version 1.26.4. The vulnerability affects repository migration functionality and results from insufficient validation of pull request patch URLs. Although Gitea validates the original migration URL against its...

CVE-2026-34966

A flaw was found in Gitea. This server-side request forgery SSRF vulnerability allows authenticated attackers to bypass existing protections. By manipulating HTTP fetch operations during migrations or OAuth avatar processing, an attacker can force the Gitea server to make requests to arbitrary...

CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

EUVD-2026-53617

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966

Gitea before 1.27.0 is affected by a server-side request forgery (SSRF) in HTTP fetch operations used by migration and OAuth avatar paths (Go http.Get without a custom DialContext). An authenticated user can supply arbitrary URLs through release asset downloads, PR patch URLs, or OAuth avatar end...

CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup

An unauthenticated attacker can read any file the service account can access on Gitea , the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1. The file-re...

SUSE CVE-2026-20896

Gitea Docker image versions up to and including 1.26.2 use REVERSEPROXYTRUSTEDPROXIES= by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled...

The vulnerability in the services/repository/files/patch.go file of the Git repository management system Gitea allows a perpetrator to execute arbitrary code and gain unauthorized access to protected information.

The vulnerability of the services/repository/files/patch.go file in the Git repository management system Gitea is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain unauthorized access to protected information...

PT-2026-65725

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.1 Description A code injection flaw exists in the services/repository/files/patch.go file due to improper code generation management. This issue allows a remote attacker with repository write access to plant a...

GO-2026-6065 Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev...

GO-2026-6080 Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag in go-gitea/gitea

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag in go-gitea/gitea. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...