GHSA-66M4-5JJR-2RG5 Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Affected product Gitea — services/repository/collaboration.go DeleteCollaboration + webhook delivery Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup...

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Affected product Gitea — services/repository/collaboration.go DeleteCollaboration + webhook delivery Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration Summary Gitea validates the user-supplied repository migration URL, but the actual clone and later mirror fetch operations are performed by the Git command-line client...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

GHSA-82F7-87HM-852X Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration Summary Gitea validates the user-supplied repository migration URL, but the actual clone and later mirror fetch operations are performed by the Git command-line client...

PT-2026-63293

Name of the Vulnerable Software and Affected Versions Gitea versions 1.22.x and earlier Description A Local File Inclusion issue exists in the restore-repo command when processing release.yml files from user-supplied archives. The DownloadURL field in release attachments is passed to the uri.Open...

PT-2026-63277

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description RSS and Atom feed handlers fail to enforce token-scope or public-only restrictions when using API-token Basic authentication. This allows a personal access token that is restricted to public-only access or lack...

PT-2026-63276

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0 Description An authenticated user can cause a denial of service by sending a large HTTP request to the NPM package tag API endpoint. The AddPackageTag function reads the entire request body into memory using...

PT-2026-63301

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.5 Description An insufficient authorization issue exists in the LFS server where the system uses the UserID embedded in an LFS JWT to make cross-repository authorization decisions via the LFSObjectAccessible function. When a...

PT-2026-63308

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated low-privilege user can perform a server-side request forgery SSRF during repository migration. The issue occurs because the validation logic in services/migrations/migrate.go...

PT-2026-63298

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description The /api/v1/teams/id API routes fail to correctly enforce the public-only access token restriction. A public-only token is designed to limit API access to public repositories and organizations; however, these...

PT-2026-63279

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but fails to enforce API token scopes before returning identity claims. This allows a token...

PT-2026-63283

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A privilege escalation issue exists in the API endpoint POST /users/username/tokens used for creating Personal Access Tokens. The endpoint is protected by the reqBasicOrRevProxyAuth middleware,...