CVE-2026-109553

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...

CVE-2026-107686

The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the...

CVE-2026-105964

The Gitea Actions artifact v4 Twirp handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gite...

CVE-2026-97859 Gitea API disclosure of private user social graph, keys and stars

Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

CVE-2026-97859

The Gitea platform contains a vulnerability where seven API routes under /api/v1/users/{username} (including followers, following, starred, subscriptions, and keys) were registered without the individualPermsChecker middleware. This oversight allows an authenticated user to access the social grap...

CVE-2026-97859 Gitea API disclosure of private user social graph, keys and stars

Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

CVE-2026-97204 Gitea label deletion across repository and organization IDs

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that...

CVE-2026-97204 Gitea label deletion across repository and organization IDs

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that...

CVE-2026-97204

In Gitea , a logic error in the label deletion process allows a user with write access to repository issues to delete organization labels . This occurs because the system incorrectly compares the repository ID against the organization ID of organization labels, where the two ID sequences overlap....

CVE-2026-110494 Gitea release attachment re-linking of issue attachments

Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This expos...

CVE-2026-110494 Gitea release attachment re-linking of issue attachments

Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This expos...

CVE-2026-110494

The Gitea application is vulnerable to an authorization bypass issue when adding attachments to a release. The software fails to verify if an attachment is already linked to an issue or comment. Consequently, a user with write access to repository releases can link an attachment using its UUID . ...

CVE-2026-110324

The Gitea platform is vulnerable to a private profile information disclosure via a POST request . The vulnerability exists because visibility checks were only enforced on GET requests; the POST /{username} endpoint (used for follow/unfollow actions) only required a signed-in session. Consequently...

CVE-2026-110324 Gitea private profile information disclosure through POST request

The visibility check of Gitea user profiles was applied to GET requests only, while POST /username follow and unfollow required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response...

CVE-2026-110324 Gitea private profile information disclosure through POST request

The visibility check of Gitea user profiles was applied to GET requests only, while POST /username follow and unfollow required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response...

CVE-2026-110311 Gitea draft release creation disclosing attachment metadata

Creating a draft release through the API returned an assets list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata file name, UUID, upload time, size...

CVE-2026-110311

The Gitea platform is vulnerable to an information disclosure flaw when creating a draft release via the API. The application returns an assets list built from a release lacking a unique ID, causing it to match every attachment not linked to a release. Consequently, an attacker with permissions t...

CVE-2026-110311 Gitea draft release creation disclosing attachment metadata

Creating a draft release through the API returned an assets list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata file name, UUID, upload time, size...

CVE-2026-109844

The Gitea repository management platform is affected by a vulnerability where the GET /api/v1/user/subscriptions endpoint fails to verify if a user still maintains access to a watched repository. Consequently, a user who previously had access to a private repository but subsequently lost those pe...

CVE-2026-109844 Gitea watched repositories API disclosure after access revocation

GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its...