21 matches found
BIT-GITEA-2026-79960 Gitea deploy key pushes acting as the repository owner
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-79960
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-79960
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-79960
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-79960
The Gitea repository management platform contains a vulnerability where pushes authenticated with a deploy key are incorrectly recorded as being performed by the repository owner. This Incorrect Authorization (CWE-863) causes permission checks in the push hook pipeline to evaluate the owner's pri...
PT-2026-107217
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description When a push is authenticated using a deploy key, the system incorrectly records the repository owner as the pusher. This causes permission checks in the push hook pipeline to evaluate the owner...
CVE-2026-79960: Incorrect Authorization
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-58437
A flaw was found in Gitea. This vulnerability allows an attacker to manipulate repository visibility settings by leveraging specific Git push options. This could lead to unauthorized disclosure of repository information or unintended access control changes. Mitigation Mitigation for this issue is...
CVE-2026-58437
Repository Visibility Manipulation via Git Push Options...
CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...
CVE-2026-58437 Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options...
CVE-2026-58437 Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options...
CVE-2026-58437
The Git repository management system Gitea is affected by a vulnerability where an attacker can manipulate repository visibility settings by leveraging specific Git push options . This issue originates from a flaw in the HookPostReceive() function within the routers/private/hook_post_receive.go f...
EUVD-2026-58164
Repository Visibility Manipulation via Git Push Options...
CVE-2026-58437: Improper Access Control
Repository Visibility Manipulation via Git Push Options...
GO-2026-6047 Gitea: Repository Visibility Manipulation via Git Push Options in gitea.dev
Gitea: Repository Visibility Manipulation via Git Push Options in gitea.dev...
Gitea: Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | Affected File | routers/private/hookpostreceive.go | | Affected Function | HookPostReceive | | Affected Lines | 173–225 | | Prerequisite | Attacker must have owner-level or admin collaborator access to t...
GHSA-8P9H-49RC-QGXJ Gitea: Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | Affected File | routers/private/hookpostreceive.go | | Affected Function | HookPostReceive | | Affected Lines | 173–225 | | Prerequisite | Attacker must have owner-level or admin collaborator access to t...
PT-2026-63303
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the...
PT-2024-37549 · Github · Github Enterprise Server
Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.14 Description: A Security Misconfiguration issue in GitHub Enterprise Server allowed unauthorized users to access sensitive information by exploiting the organization ruleset feature. This require...