Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo

Summary Any authenticated low-privilege user with read access to a repository can push arbitrary commits directly to that repository, bypassing all write-access checks. Vulnerability Gitea's "Allow edits from maintainers" PR option can be abused via reverse-fork PRs: 1. The web UI PR-create...

Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication

Summary Gitea fails to enforce OAuth2 access token scopes when the token is submitted via HTTP Basic authentication instead of a Bearer token. An OAuth2 application granted only read:user can use the same token as Authorization: Basic base64:x-oauth-basic and perform write actions, including...

GHSA-9R5X-WG6M-X2RC Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication

Summary Gitea fails to enforce OAuth2 access token scopes when the token is submitted via HTTP Basic authentication instead of a Bearer token. An OAuth2 application granted only read:user can use the same token as Authorization: Basic base64:x-oauth-basic and perform write actions, including...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of token scope validation in the CheckRepoScopedToken function. An attacker can gain unauthorized access to private repository contents by presenting a valid personal access token or...

GHSA-CC8W-R4QH-3V65 Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens

Summary Gitea v1.26.1 enforces repository-scoped access-token permissions on repository operations. In the Git Smart HTTP path, however, this check runs only when the token is presented via HTTP Basic authentication — CheckRepoScopedToken returns early unless ctx.IsBasicAuth is true — so the same...

Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens

Summary Gitea v1.26.1 enforces repository-scoped access-token permissions on repository operations. In the Git Smart HTTP path, however, this check runs only when the token is presented via HTTP Basic authentication — CheckRepoScopedToken returns early unless ctx.IsBasicAuth is true — so the same...

PT-2026-50137

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authorization bypass exists in three API endpoints that allow users to read specific files from a private repository's default branch even if they lack the required Code unit permissions. Th...

PT-2026-50136

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authorization bypass allows any authenticated low-privilege user with read access to a repository to push arbitrary commits directly to that repository, bypassing write-access checks. This...

CVE-2026-25779

creationtimestamp| type| source ---|---|--- 2026-06-14 20:15:17+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-j5r2-4c8j-xc3m...

CVE-2026-24791

creationtimestamp| type| source ---|---|--- 2026-06-14 20:09:21+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-wrr5-99h5-gq57 2026-08-14 12:45:18+00:00| seen|...

PT-2026-50586

Name of the Vulnerable Software and Affected Versions Gitea versions 1.25.0 and later Description Gitea is subject to stored cross-site scripting XSS through the built-in 3D file viewer, which utilizes the Online3DViewer library. The issue occurs when a .gltf file contains an unsupported extensio...

Exploit for CVE-2026-28699

CVE-2026-28699 — Gitea OAuth2 Scope Bypass via HTTP Basic Auth...

PT-2026-48628

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea fails to enforce OAuth2 access token scopes when a token is submitted via HTTP Basic authentication instead of a Bearer token. This occurs because the authentication process in...

CVE-2026-27783

creationtimestamp| type| source ---|---|--- 2026-06-05 22:23:59+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-3fwp-p5rj-2pxf...

CVE-2026-26231

creationtimestamp| type| source ---|---|--- 2026-06-05 22:22:34+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r 2026-07-05 20:00:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpweisht6r2g...

CVE-2026-28699

creationtimestamp| type| source ---|---|--- 2026-06-05 22:22:25+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc 2026-06-11 09:00:04+00:00| published-proof-of-concept| Telegram/X3d0ovB01fXeFh1HIc4iOWU-yKPAhiRlXClKZPas190B7A 2026-06-11...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, external-secrets-operator, snyk-cli, terraform-provider-acme, mattermost, fq, k3s, grafana-pyroscope, gptscript, zot, prometheus-operator, caddy, kine, crossplane-provider-azure-storage, kots, gitea, kubernetes-dashboard, kyverno,...

CVE-2026-25681 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, external-secrets-operator, snyk-cli, terraform-provider-acme, mattermost, fq, k3s, grafana-pyroscope, gptscript, zot, prometheus-operator, caddy, kine, crossplane-provider-azure-storage, kots, gitea, kubernetes-dashboard, kyverno,...

CVE-2026-42506 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, external-secrets-operator, snyk-cli, terraform-provider-acme, mattermost, fq, k3s, grafana-pyroscope, gptscript, zot, prometheus-operator, caddy, kine, crossplane-provider-azure-storage, kots, gitea, kubernetes-dashboard, kyverno,...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, external-secrets-operator, snyk-cli, terraform-provider-acme, mattermost, fq, k3s, grafana-pyroscope, gptscript, zot, prometheus-operator, caddy, kine, crossplane-provider-azure-storage, kots, gitea, kubernetes-dashboard, kyverno,...