1986 matches found
CVE-2026-25712 Gitea organization permission APIs expose private visibility information
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations...
CVE-2026-25038 Gitea private organization labels are visible to unauthorized users
Gitea 1.26.2 allows unauthorized users to access labels of private organizations...
CVE-2026-25038
Gitea 1.26.2 allows unauthorized users to access labels of private organizations...
CVE-2026-25714
Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941...
CVE-2026-25714
Gitea is vulnerable to CVE-2026-25714: versions up to 1.26.1 do not consistently apply public-only token filtering in the user orgs API, leaving an incomplete fix for CVE-2025-68941. This allows a public-only token to enumerate private organizations belonging to the token owner, violating scope r...
CVE-2026-25714 Gitea user organization API bypasses public-only token filtering
Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941...
CVE-2026-25714 Gitea user organization API bypasses public-only token filtering
Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941...
CVE-2026-25038
Gitea 1.26.2 contains a Missing Authorization vulnerability that allows unauthorized users to access labels of private organizations. The issue is confirmed across multiple sources; CVSSv3.1 base score is 7.5 (High), with network attack vector and no user interaction required. A fix is available:...
CVE-2026-22874
Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering...
CVE-2026-24451 Gitea fork synchronization can expose private parent repository data
Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized...
CVE-2026-22874
Gitea up to version 1.26.2 has incomplete SSRF protection in webhook and migration allow-list filtering (CVE-2026-22874). Affected: Gitea 1.26.x prior to 1.26.3. The issue exposes SSRF risk due to insufficient filtering in webhook and migration allow-list mechanisms. Patches addressing this belon...
CVE-2026-22874 Gitea webhook and migration allow-list filtering permits SSRF
Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering...
CVE-2026-24451 Gitea fork synchronization can expose private parent repository data
Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized...
CVE-2026-24451
Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized...
CVE-2026-24451
Gitea 1.26.2 has an information exposure vulnerability where fork synchronization continues after the parent repo switches from public to private, allowing a fork to access data it should not be authorized to see. Connected sources identify this as affecting Gitea components through the fork sync...
CVE-2026-24690
Gitea before version 1.25.5 contains insufficient permission checks when updating or rebasing pull request branches, enabling an access control bypass. The issue affects the pull service logic (e.g., related to PR update/rebase paths) and has been addressed by upgrading to Gitea 1.25.5 or later. ...
EUVD-2026-41620
Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches...
CVE-2026-24690
Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches...