22725 matches found
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through the RemoveDependency function. An attacker can modify issue dependencies and inject comments into private repositories by submitting a crafted request referencing the global issue ID of a private repository...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through the RemoveDependency function. An attacker can modify issue dependencies and inject comments into private repositories by submitting a crafted request referencing the global issue ID of a private repository...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through the RemoveDependency function. An attacker can modify issue dependencies and inject comments into private repositories by submitting a crafted request referencing the global issue ID of a private repository...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through the RemoveDependency function. An attacker can modify issue dependencies and inject comments into private repositories by submitting a crafted request referencing the global issue ID of a private repository...
EUVD-2026-41608
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write...
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
Summary Gitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the original HMAC signature. An attacker with permission to run a Gitea Actions job can turn a signed URL for an attacker-controlled artifact...
GHSA-HG5R-VQ93-9FV6 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
Summary Gitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the original HMAC signature. An attacker with permission to run a Gitea Actions job can turn a signed URL for an attacker-controlled artifact...
GHSA-RQHX-647V-WX32 Gitea: SSRF via HTTP Redirect in Repository Migration
Summary Gitea 1.25.4 validates the initial URL provided to the repository migration endpoint POST /api/v1/repos/migrate and correctly blocks requests to internal addresses like 127.0.0.1 or RFC1918 ranges. However, if the initial URL points to an attacker-controlled server that responds with an...
Gitea: SSRF via HTTP Redirect in Repository Migration
Summary Gitea 1.25.4 validates the initial URL provided to the repository migration endpoint POST /api/v1/repos/migrate and correctly blocks requests to internal addresses like 127.0.0.1 or RFC1918 ranges. However, if the initial URL points to an attacker-controlled server that responds with an...
EUVD-2026-41602
Gitea: SSRF via HTTP Redirect in Repository Migration...
GHSA-3PWW-VCVM-3GMJ Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
Summary A Gitea personal access token PAT restricted to a non-repository scope e.g. read:issue can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied 403 on /raw, /media, /archive, and the...
Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
Summary A Gitea personal access token PAT restricted to a non-repository scope e.g. read:issue can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied 403 on /raw, /media, /archive, and the...
EUVD-2026-41634
Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data...
GHSA-2M9V-5Q2G-58VQ Gitea: Git LFS object reuse allows non-Code access to authorize private source objects
Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be...
Gitea: Git LFS object reuse allows non-Code access to authorize private source objects
Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be...
EUVD-2026-41643
Gitea: Git LFS object reuse allows non-Code access to authorize private source objects...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization through insufficient authorization checks in the fork API endpoint. An attacker can create repositories within an organization despite lacking the necessary permissions by sending a crafted API request to the...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization through insufficient authorization checks in the fork API endpoint. An attacker can create repositories within an organization despite lacking the necessary permissions by sending a crafted API request to the...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization through insufficient authorization checks in the fork API endpoint. An attacker can create repositories within an organization despite lacking the necessary permissions by sending a crafted API request to the...
GHSA-P4MJ-98MV-XQ26 Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint
| Field | Value | |-------|-------| | Affected File | routers/web/repo/githttp.go, services/context/repo.go | | Affected Functions | httpBase, EarlyResponseForGoGetMeta | | Affected Lines | githttp.go:63–66, services/context/repo.go:374–396 | | Prerequisite | None — fully unauthenticated | ---...