CVE-2026-58432

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...

CVE-2026-58314

Two SSRF findings in Gitea 1.26.2...

CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-56657

Gitea SSH Key Parser Denial of Service...

CVE-2026-24059 Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-24059

The CVE-2026-24059 detail shows a flaw in the Gitea runner registration-token GET endpoint: when invoked at project- or owner-level, it creates a new runner registration token if none exists, but is gated by a read-only scope. A leaked read:user-scoped token can therefore mint a registration toke...

CVE-2026-24059 Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

EUVD-2026-58125

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

CVE-2026-59763

CVE-2026-59763 affects Gitea’s package upload flow, where unbounded Arch package file metadata can cause resource amplification (availability impact). The issue is tied to Arch metadata handling in the package upload pipeline, leading to potential denial of service through resource exhaustion. Pu...

CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...

CVE-2026-58508 Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...

CVE-2026-58508

Technical details (affected product/component, root cause, impact, and exploitation specifics) are not publicly available in the provided documents. Monitor for official disclosures and updates.

CVE-2026-58508 Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...

CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation (CVE-2026-58435) affects Gitea prior to patch in 1.25.5, per advisory GHSA-rh79-75qm-gwjr. Root cause: when a write deploy key authenticates over SSH, the code sets UserID to the repo owner and embeds this into the LFS JWT, then cross-repo access decision...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58432

CVE-2026-58432 relates to Gitea (code.gitea.io/gitea) and describes missing authorization and an authorization bypass via a user-controlled key, plus incorrect permissions on a critical resource that could expose sensitive information to an unauthorized actor. The CVE is rated with CVSS v3.1 base...