SUSE CVE-2026-20904

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities...

SUSE CVE-2026-20912

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users...

GO-2026-4368 Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea...

GO-2026-4365 Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea...

GO-2026-4369 Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea...

GO-2026-4366 Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea...

GO-2026-4362 Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea...

GO-2026-4364 Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea...

GO-2026-4370 Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea...

GO-2026-4367 Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

Gitea has improper access control for uploaded attachments in code.gitea.io/gitea...

GO-2026-4363 Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea...

BIT-GITEA-2026-20912 Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users...

BIT-GITEA-2026-20904 Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities...

BIT-GITEA-2026-20897 Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories...

BIT-GITEA-2026-20888 Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users...

BIT-GITEA-2026-20883 Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure

Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches...

BIT-GITEA-2026-20800 Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications...

BIT-GITEA-2026-20750 Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)

Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization...

BIT-GITEA-2026-20736 Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check

Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access...

BIT-GITEA-2026-0798 Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags,...