Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Author: Prakhar Porwal Date: 2026-05-24 Target: Gitea self-hosted Git service Branch tested: main @ b7e95cc48c development build, go1.26.3 Component: routers/api/v1/org/action.go org-level Actions API OWASP: API3:2023 Broken Object Property Level Authorization --- 1. Summary The org-level Actions...

GHSA-FRPW-3H2Q-4JJ6 Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Author: Prakhar Porwal Date: 2026-05-24 Target: Gitea self-hosted Git service Branch tested: main @ b7e95cc48c development build, go1.26.3 Component: routers/api/v1/org/action.go org-level Actions API OWASP: API3:2023 Broken Object Property Level Authorization --- 1. Summary The org-level Actions...

GHSA-Q423-49RW-G9MH Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Summary GHSA-8fwc-qjw5-rvgp "Gitea may send release notification emails for private repositories to users whose access has been revoked", fix in PR 36319 / commit 8a98ac22 added repomodel.ClearRepoWatches as a defense for the state transition public→private. The cleanup was wired into...

Gitea: Public-only API token restriction is not enforced on team API routes

Summary Gitea's /api/v1/teams/id API routes do not correctly enforce the public-only access token restriction. A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata...

GHSA-H56G-4QW7-2MXG Gitea: Public-only API token restriction is not enforced on team API routes

Summary Gitea's /api/v1/teams/id API routes do not correctly enforce the public-only access token restriction. A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata...

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Summary PR 38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members not just public ones of a private organization. Affected Versions = v1.26.4 latest and main branch Root Cause routers/api/v1/org/member.go — ListMembers: // Missing...

GHSA-G9G6-QHRC-P3QC Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated Disable Account action and issuing a fresh authenticated session in t...

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated Disable Account action and issuing a fresh authenticated session in t...

Gitea: Notification API leaks private issue metadata after access revocation

Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation,...

GHSA-44QC-PGVP-WX7V Gitea: Notification API leaks private issue metadata after access revocation

Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation,...

GHSA-V73X-HX65-6PF4 Gitea: Unauthorized Access to Labels of Private Organizations

Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpoints. A user without access to a private organization can retrieve labels belonging to that organization through the Organization Labels API. As a result, label metadata intended to...

EUVD-2026-41621

Gitea: Unauthorized Access to Labels of Private Organizations...

EUVD-2026-41636

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write...

GHSA-649P-MMHF-85C7 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High | | Bug...

EUVD-2026-41619

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private...

GHSA-WRF9-R3H7-7X5V Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Summary The POST /api/v1/repos/owner/repo/merge-upstream endpoint continues to synchronize commits from a parent repository after the parent repository has been changed from public to private. A fork created while the parent repository was public can still receive commits made after the parent...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the handling of outbound HTTP requests for webhooks, repository migration, and OpenID sign-in due to insufficient filtering of non-routable and internal IP address ranges. An attacker can access...

Gitea: Two SSRF findings

| --- | --- | | Versions tested | gitea/gitea:1.26.2 digest sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031; gitea/gitea:latest resolves to the same digest at time of writing | | Source review | git checkout v1.26.2 commit 2c749ce | | Reproduction | bash runpoc.sh single...

GHSA-2FCR-JFVC-VGG2 Gitea: Two SSRF findings

| --- | --- | | Versions tested | gitea/gitea:1.26.2 digest sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031; gitea/gitea:latest resolves to the same digest at time of writing | | Source review | git checkout v1.26.2 commit 2c749ce | | Reproduction | bash runpoc.sh single...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the handling of outbound HTTP requests for webhooks, repository migration, and OpenID sign-in due to insufficient filtering of non-routable and internal IP address ranges. An attacker can access...