Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the UpdatePullRequest function. An attacker can cause unauthorized modifications to private repository branches by exploiting a logic flaw in token scope validation during pull request updates from a publ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the UpdatePullRequest function. An attacker can cause unauthorized modifications to private repository branches by exploiting a logic flaw in token scope validation during pull request updates from a publ...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the RemoveDependency function. An attacker can modify issue dependencies and inject comments into private repositories by submitting a crafted request referencing the global issue ID of a private repository...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the RemoveDependency function. An attacker can modify issue dependencies and inject comments into private repositories by submitting a crafted request referencing the global issue ID of a private repository...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the RemoveDependency function. An attacker can modify issue dependencies and inject comments into private repositories by submitting a crafted request referencing the global issue ID of a private repository...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the RemoveDependency function. An attacker can modify issue dependencies and inject comments into private repositories by submitting a crafted request referencing the global issue ID of a private repository...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the RemoveDependency function. An attacker can modify issue dependencies and inject comments into private repositories by submitting a crafted request referencing the global issue ID of a private repository...

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Summary A Gitea personal access token PAT restricted to a non-repository scope e.g. read:issue can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied 403 on /raw, /media, /archive, and the...

GHSA-3PWW-VCVM-3GMJ Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Summary A Gitea personal access token PAT restricted to a non-repository scope e.g. read:issue can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied 403 on /raw, /media, /archive, and the...

EUVD-2026-41634

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data...

GHSA-2M9V-5Q2G-58VQ Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be...

GHSA-P4MJ-98MV-XQ26 Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

| Field | Value | |-------|-------| | Affected File | routers/web/repo/githttp.go, services/context/repo.go | | Affected Functions | httpBase, EarlyResponseForGoGetMeta | | Affected Lines | githttp.go:63–66, services/context/repo.go:374–396 | | Prerequisite | None — fully unauthenticated | ---...

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

| Field | Value | |-------|-------| | Affected File | routers/web/repo/githttp.go, services/context/repo.go | | Affected Functions | httpBase, EarlyResponseForGoGetMeta | | Affected Lines | githttp.go:63–66, services/context/repo.go:374–396 | | Prerequisite | None — fully unauthenticated | ---...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via the EarlyResponseForGoGetMeta function. An attacker can obtain sensitive repository metadata, such as the existence of private repositories, their clone URLs, and default branch...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the attachment update. An attacker can access private attachment content by re-linking a known attachment UUID to an issue or comment in a repository they control, causing authorization checks to be performed...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the attachment update. An attacker can access private attachment content by re-linking a known attachment UUID to an issue or comment in a repository they control, causing authorization checks to be performed...

GHSA-QF2F-QH6P-7V89 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo access at output time: - GET /api/v1/user/starred — getStarredRepos computes a per-repo...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the getStarredRepos and ListMyTrackedTimes functions. An attacker can access private repository metadata and private issue titles after their access has been revoked by sending requests to the affected API...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the getStarredRepos and ListMyTrackedTimes functions. An attacker can access private repository metadata and private issue titles after their access has been revoked by sending requests to the affected API...

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Affected product Gitea — services/repository/collaboration.go DeleteCollaboration + webhook delivery Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup...