2041 matches found
Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
This is a cross-repository IDOR / broken access control issue. An attacker can tamper with issue-tracking state dependency relationships and inject an attacker-authored comment into a private repository they cannot otherwise read or write to, crossing a trust boundary the "add" path explicitly...
PT-2026-63312
Name of the Vulnerable Software and Affected Versions Gitea versions 1.25.4 through 2026-05-16 Description When a public repository is changed to private via the REST API, watch records are not properly cleared. This occurs because the updateRepository function, which is utilized by the PATCH...
PT-2026-63294
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.2 Description An issue exists where the OAuth token introspection endpoint allows any authenticated OAuth client to retrieve metadata for tokens issued to other clients, violating RFC 7662 section 4. The server fai...
PT-2026-63285
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An issue exists in the Remember-Me token validation logic where the system fails to invalidate all active sessions when a compromised token is detected. Gitea uses a split token design consisti...
PT-2026-63281
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An issue exists in the OAuth2 sign-in callback that allows a deactivated user account to be reactivated when signing in through an authentication source that does not issue refresh tokens, such...
Gitea: REST API exposes organization membership of private organizations to public
The endpoint "/orgs/org/publicmembers/username" + GET exposes organization membership of public members in a private organization...
Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
PR 38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members not just public ones of a private organization...
Gitea: Local File Inclusion via file:// URI in Migration Restore
Gitea's restore-repo command processes release.yml files from a user-supplied archive. The DownloadURL field in each release attachment is passed to uri.Open without scheme validation. Because uri.Open supports the file:// scheme via os.Open, an operator-level attacker can plant a crafted...
PT-2026-63289
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authorization issue exists in the organization-level Actions REST endpoints. The endpoints /api/v1/orgs/org/actions/runs and /api/v1/orgs/org/actions/jobs only verify organization membership...
PT-2026-63282
Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description A bypass exists for the public-only Personal Access Token PAT scope when the owner's visibility is set to Limited instance-internal. While other scope categories correctly reject Limited owners, the Repository...
PT-2026-63307
Name of the Vulnerable Software and Affected Versions Gitea versions 1.26.4 and earlier Description The restore-repo CLI command fails to properly validate the Head.CloneURL field when parsing pull request.yml from a repository dump. The safety check function CheckAndEnsureSafePR is called with a...
PT-2026-63305
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0 Description Gitea fails to re-evaluate the official flag on existing pull request reviews when the target branch of a pull request is changed. An attacker with write access to a repository can obtain an official:...
Gitea: Public-only API token restriction is not enforced on team API routes
Gitea's /api/v1/teams/id API routes do not correctly enforce the public-only access token restriction. A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata and...
Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
GetActionsUserRepoPermission models/perm/access/repopermission.go decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — except the collaborative-owner branch, which is missing the !task.IsForkPullRequest guard that its sibli...
PT-2026-61704
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0 Description Gitea allows a token with public-only,write:repository restrictions to update a private pull request head branch. This occurs because the system validates the token's public-only restriction against t...
Gitea has insufficient permission checks for Composer package source links
CVE Description Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. Summary A critical vulnerability has been discovered in Gitea. It was already reported via...
EUVD-2026-41635
Gitea has insufficient permission checks for Composer package source links...
GHSA-8QW8-RQ86-9PC2 Gitea has insufficient permission checks for Composer package source links
CVE Description Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. Summary A critical vulnerability has been discovered in Gitea. It was already reported via...
