Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the checkTokenPublicOnly function when handling Repository and Package categories with owners set to limited visibility. An attacker can gain unauthorized access to internal repository or package content by...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through changing a pull request's target branch without re-evaluating the official approval status on existing reviews. An attacker can bypass branch protection requirements and merge code into protected branches...

GHSA-W5PG-649R-P6GG Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Summary Gitea does not re-evaluate the official flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access to a repository can obtain an official: true approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch e.g.,...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through changing a pull request's target branch without re-evaluating the official approval status on existing reviews. An attacker can bypass branch protection requirements and merge code into protected branches...

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Summary Gitea does not re-evaluate the official flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access to a repository can obtain an official: true approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch e.g.,...

GHSA-66M4-5JJR-2RG5 Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Affected product Gitea — services/repository/collaboration.go DeleteCollaboration + webhook delivery Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup...

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Affected product Gitea — services/repository/collaboration.go DeleteCollaboration + webhook delivery Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration Summary Gitea validates the user-supplied repository migration URL, but the actual clone and later mirror fetch operations are performed by the Git command-line client...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...

GHSA-82F7-87HM-852X Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration Summary Gitea validates the user-supplied repository migration URL, but the actual clone and later mirror fetch operations are performed by the Git command-line client...

PT-2026-63298

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description The /api/v1/teams/id API routes fail to correctly enforce the public-only access token restriction. A public-only token is designed to limit API access to public repositories and organizations; however, these...

PT-2026-63308

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated low-privilege user can perform a server-side request forgery SSRF during repository migration. The issue occurs because the validation logic in services/migrations/migrate.go...

PT-2026-63301

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.5 Description An insufficient authorization issue exists in the LFS server where the system uses the UserID embedded in an LFS JWT to make cross-repository authorization decisions via the LFSObjectAccessible function. When a...