CVE-2026-96580

The Gitea platform is vulnerable to memory exhaustion due to an uncontrolled resource consumption issue (CWE-400) within its Actions functionality. The vulnerability occurs because the system expands a workflow's static strategy.matrix into a full Cartesian product without a size limit when creat...

CVE-2026-103670

The Gitea actions system is vulnerable to unauthorized workflow cancellation. When a new actions run is inserted into a concurrency group with cancel-in-progress enabled, the system cancels older runs without verifying if the new run requires approval. Because fork pull request runs are inserted ...

GO-2026-6060 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea...

EUVD-2026-41608

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization in the workflow approval process. An attacker can gain unauthorized access to protected resources or perform privileged actions by bypassing the intended approval gate through manipulation of permanent fork pull...

CVE-2026-58426 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write...

CVE-2026-58426 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write...

CVE-2026-58426: Improper Verification of Cryptographic Signature

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write...