CVE-2026-20896

Proof-of-Concept-Code CVE-2026-20896 Dieses Skript automatisiert die Ausnutzung des Logikfehlers in der Routenvalidierung der Gitea-API und ermöglicht es, den Server zu zwingen, einen gültigen administrativen Token durch einen Directory-Traversal-Angriff im Autorisierungsheader zu gewähren...

Gitea <1.16.5 - Open Redirect

Gitea before 1.16.5 is susceptible to open redirect via GitHub repository go-gitea/gitea. An attacker can redirect a user to a malicious site and potentially obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-1058 info: name: Gitea 1.16.5 - Open Redire...

Gitea Container Registry - Unauthorized Private Image Access

Gitea = 1.26.2. As a temporary workaround, set REQUIRESIGNINVIEW=true in gitea app.ini, though this blocks all anonymous access including public repos. reference: - https://blog.gitea.com/release-of-1.26.2/ - https://github.com/go-gitea/gitea/pull/37290 -...

Gitea 1.1.0 - 1.12.5 - Remote Code Execution

Gitea 1.1.0 through 1.12.5 is susceptible to authenticated remote code execution, via the git hook functionality, in customer environments where the documentation is not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the...

Gitea < 1.4.3 - Open Redirect

Gitea before version 1.4.3 is affected by URL Redirection to Untrusted Site 'Open Redirect' via internal URLs. The vulnerability exists in the redirectto parameter used on the login page /user/login. Due to improper validation of the redirect URL, an attacker can craft a malicious link that...

Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass

The official Gitea Docker image through version 1.26.2 ships with REVERSEPROXYTRUSTEDPROXIES set to a wildcard, causing Gitea to trust reverse-proxy authentication headers X-WEBAUTH-USER from any source IP instead of restricting trust to the configured reverse proxy. When reverse-proxy...

Gitea 1.22.0 - Cross-Site Scripting

Gitea 1.22.0 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to inject malicious scripts that get stored on the server and executed in the context of another user's session. id: CVE-2024-6886 info: name: Gitea 1.22.0 - Cross-Site Scripting...

Lab-001-Gitea-CVE-2026-20896-

Lab-001-Gitea-CVE-2026-20896-...

cicd-goat

Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, capture the flags. 🚩 Created by Cider Security Acquired by Palo Alto Networks. Table of Contents...

Gitea-Forgejo-CVE-2025-68937

Vulnerabilità di espansione arbitraria dei template in Gitea e Forgejo Quest'opera è distribuita con licenza Creative Commons Attribution-ShareAlike 4.0 International License. Sommario Durante l'analisi del codice sorgente di Forgejo e Gitea per comprendere meglio come viene eseguito il templatin...

gitea-CVE-2026-28699

CVE-2026-28699: Bypass dello Scope OAuth2 di Gitea tramite HTTP Basic Auth Un token di accesso OAuth2 di Gitea con scope limitato a solo read:user può eseguire azioni di scrittura complete quando viene inviato come Authorization: Basic base64:x-oauth-basic invece che come token Bearer. Il control...

CVE-2026-57897

A flaw was found in Gitea. This vulnerability allows for cross-repository information disclosure through the use of Org-Level Actions Run/Job Application Programming Interfaces APIs. An attacker could exploit this to gain unauthorized access to sensitive information across different repositories...

CVE-2026-58314

A flaw was found in Gitea. This vulnerability, known as Server-Side Request Forgery SSRF, allows an attacker to trick the server into making requests to internal network resources. A logged-in user can exploit this by crafting malicious webhooks or repository migration configurations, leading to...

CVE-2020-14144-GiTea-git-hooks-rce

CVE-2020-14144 - تنفيذ التعليمات البرمجية عن بُعد بعد المصادقة في GiTea سكربت لاستغلال CVE-2020-14144 - تنفيذ التعليمات البرمجية عن بُعد بعد المصادقة في GiTea باستخدام git hooks الميزات توليد تلقائي لحمولة القشرة العكسية Reverse Shell من IP والمنفذ رفع سكربت شل مخصص وتنفيذه عن بُعد باستخدام الخيا...

cve-2026-22874-gitea-ssrf-allowlist

CVE-2026-22874 — Protezione SSRF incompleta nella lista di permessi di webhook e migrazione di Gitea Descrizione tecnica e riferimenti per CVE-2026-22874 GHSA-2r5c-gw76-rh3w: una lista di permessi SSRF incompleta nella consegna dei webhook e nella migrazione dei repository di Gitea, corretta in...

CVE-2026-60004-POC

CVE-2026-60004 — Execução Remota de Código Pré-Autenticação no Gitea CVSS 9.8 root@kitploit: ┌──────────────────────────────────────────────────────────────┐ │ CVE-2026-60004 │ Gitea Pre-Auth RCE │ CVSS 9.8 CRIT │ │ diffpatch → git hook injection │ v1.17–1.27.0 affected │...

cve-2026-20896-gitea-poc

Verificador de Bypass de Autenticação Docker Gitea CVE-2026-20896 Apenas para operações autorizadas de red team / pentest. Este repositório contém um verificador mínimo para o CVE-2026-20896, um bypass de autenticação em imagens oficiais do Gitea Docker até a versão 1.26.2 quando a autenticação p...

CVE-2026-58424

CVE-2026-58424 – Gitea Fork-PR-Workflow-Genehmigungsgate-Umgehung Schweregrad: Hoch CVSS 8.9 Betroffen: Gitea ≤ 1.26.2 Behoben in: Gitea 1.26.3 Advisory: GHSA-777r-4v59-6486 Beschreibung der Schwachstelle Gitea Actions erzwingt ein Genehmigungsgate für Workflow-Ausführungen, die durch...

CVE-2026-20896-Gitea-Authentication-Bypass

CVE-2026-20896 - Bypass dell'autenticazione di Gitea ≤1.26.2 1. Cos'è Gitea? Gitea è una piattaforma di hosting Git leggera e open-source che consente a organizzazioni e sviluppatori di gestire repository di codice sorgente, tracciare issue, revisionare le modifiche e collaborare su progetti...

CVE-2026-60004-poc-gitea

CVE-2026-60004 Proof-of-Concept PoC Überblick Dieses Repository enthält ein Proof-of-Concept-Tool für CVE-2026-60004, einen authentifizierten oder vorauthentifizierten Remote-Code-Execution-RCE-Vektor, der bestimmte Gitea-Versionen über die diffpatch-Hook-Injection-Technik betrifft. Die primäre...