CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

EUVD-2026-53617

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966

Gitea before 1.27.0 is affected by a server-side request forgery (SSRF) in HTTP fetch operations used by migration and OAuth avatar paths (Go http.Get without a custom DialContext). An authenticated user can supply arbitrary URLs through release asset downloads, PR patch URLs, or OAuth avatar end...

CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

PT-2026-65725

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Repository writers can execute arbitrary shell commands as the Gitea service account by planting a malicious Git hook. On instances with default configurations, external users can register,...

GO-2026-6059 Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev

Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev...

GO-2026-6082 Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint in gitea.dev

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint in gitea.dev...

GO-2026-6068 Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 in gitea.dev

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR 38145 in gitea.dev...

GO-2026-6083 Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim in gitea.dev

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim in gitea.dev...

GO-2026-6058 Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev...

GO-2026-6071 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` in gitea.dev

Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via /api/v1/user/starred and private issue titles via /api/v1/user/times in gitea.dev...

GO-2026-6080 Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag in go-gitea/gitea

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag in go-gitea/gitea. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-6065 Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev...

GO-2026-6066 Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint in gitea.dev

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint in gitea.dev...

GO-2026-6062 Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev

Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev...

GO-2026-6084 Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL in gitea.dev

Gitea: SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL in gitea.dev...

GO-2026-6085 Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev...