2038 matches found
Gitea: Notification API leaks private issue metadata after access revocation
Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation,...
GHSA-44QC-PGVP-WX7V Gitea: Notification API leaks private issue metadata after access revocation
Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation,...
GHSA-V73X-HX65-6PF4 Gitea: Unauthorized Access to Labels of Private Organizations
Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpoints. A user without access to a private organization can retrieve labels belonging to that organization through the Organization Labels API. As a result, label metadata intended to...
EUVD-2026-41621
Gitea: Unauthorized Access to Labels of Private Organizations...
EUVD-2026-41636
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write...
GHSA-649P-MMHF-85C7 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High | | Bug...
EUVD-2026-41619
Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private...
GHSA-WRF9-R3H7-7X5V Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private
Summary The POST /api/v1/repos/owner/repo/merge-upstream endpoint continues to synchronize commits from a parent repository after the parent repository has been changed from public to private. A fork created while the parent repository was public can still receive commits made after the parent...
Gitea: Two SSRF findings
| --- | --- | | Versions tested | gitea/gitea:1.26.2 digest sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031; gitea/gitea:latest resolves to the same digest at time of writing | | Source review | git checkout v1.26.2 commit 2c749ce | | Reproduction | bash runpoc.sh single...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the handling of outbound HTTP requests for webhooks, repository migration, and OpenID sign-in due to insufficient filtering of non-routable and internal IP address ranges. An attacker can access...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the handling of outbound HTTP requests for webhooks, repository migration, and OpenID sign-in due to insufficient filtering of non-routable and internal IP address ranges. An attacker can access...
GHSA-2FCR-JFVC-VGG2 Gitea: Two SSRF findings
| --- | --- | | Versions tested | gitea/gitea:1.26.2 digest sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031; gitea/gitea:latest resolves to the same digest at time of writing | | Source review | git checkout v1.26.2 commit 2c749ce | | Reproduction | bash runpoc.sh single...
GHSA-FW57-JGCH-PGF3 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Summary The Locale middleware that runs in front of every unauthenticated request calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing a size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language...
Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Summary The Locale middleware that runs in front of every unauthenticated request calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing a size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language...
Gitea SSH Key Parser Denial of Service
Gitea's SSH key ingestion endpoint accepts keys in RFC 4716 SSH2 format and normalises them before storage. The normalisation function contains an ON² string concatenation loop with no input size limit, meaning a single malicious key submission can force the server to perform an amount of work th...
GHSA-4XJF-493Q-98P3 Gitea SSH Key Parser Denial of Service
Gitea's SSH key ingestion endpoint accepts keys in RFC 4716 SSH2 format and normalises them before storage. The normalisation function contains an ON² string concatenation loop with no input size limit, meaning a single malicious key submission can force the server to perform an amount of work th...
Gitea: Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | Affected File | routers/private/hookpostreceive.go | | Affected Function | HookPostReceive | | Affected Lines | 173–225 | | Prerequisite | Attacker must have owner-level or admin collaborator access to t...
Insufficient Logging
Overview Affected versions of this package are vulnerable to Insufficient Logging through the processing of undocumented git push options in the HookPostReceive function. An attacker can change the visibility or template status of a repository without triggering audit logs, webhooks, or...
GHSA-8P9H-49RC-QGXJ Gitea: Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | Affected File | routers/private/hookpostreceive.go | | Affected Function | HookPostReceive | | Affected Lines | 173–225 | | Prerequisite | Attacker must have owner-level or admin collaborator access to t...
Insufficient Logging
Overview Affected versions of this package are vulnerable to Insufficient Logging through the processing of undocumented git push options in the HookPostReceive function. An attacker can change the visibility or template status of a repository without triggering audit logs, webhooks, or...