PT-2026-63287

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Issue and comment attachment update paths allow the use of attachment UUIDs without verifying if the attachment belongs to the target repository. An authenticated attacker can re-link a victim'...

PT-2026-63314

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user with package publishing permissions can cause resource amplification by uploading a specially crafted Arch package archive. The system records non-dot regular file entries...

PT-2026-62817

Name of the Vulnerable Software and Affected Versions Oracle Demand Signal Repository versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via SQL to compromise the system. Successful exploitation can lead to...

PT-2026-63312

Name of the Vulnerable Software and Affected Versions Gitea versions 1.25.4 through 2026-05-16 Description When a public repository is changed to private via the REST API, watch records are not properly cleared. This occurs because the updateRepository function, which is utilized by the PATCH...

CVE-2026-60840: Improper Access Control

Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Demand...

CVE-2026-15927: Server-Side Request Forgery (SSRF)

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...

PT-2026-63282

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description A bypass exists for the public-only Personal Access Token PAT scope when the owner's visibility is set to Limited instance-internal. While other scope categories correctly reject Limited owners, the Repository...

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be caused by...

PT-2026-63303

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the...

PT-2026-63309

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A scope enforcement bypass exists for personal access tokens on the repository home page endpoint 'GET /owner/repo'. This flaw allows an attacker to disclose the contents of private repositorie...

PT-2026-63307

Name of the Vulnerable Software and Affected Versions Gitea versions 1.26.4 and earlier Description The restore-repo CLI command fails to properly validate the Head.CloneURL field when parsing pull request.yml from a repository dump. The safety check function CheckAndEnsureSafePR is called with a...

PT-2026-63280

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The AddTime API handler fails to stop execution after an error is returned by the GetUserByName function. When a repository administrator provides a non-existent user name, the system generates...

PT-2026-63300

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A user who previously had access to a private repository can continue to obtain repository metadata after their access has been revoked. While direct access to the repository is correctly denie...

PT-2026-63304

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.5 Description A broken access control issue exists in the RemoveDependency function within routers/web/repo/issue dependency.go. The function processes the removeDependencyID form parameter to identify and remove a...

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

GetActionsUserRepoPermission models/perm/access/repopermission.go decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — except the collaborative-owner branch, which is missing the !task.IsForkPullRequest guard that its sibli...

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

After PR 37118 / CVE-2026-25714 fix: Unify public-only token filtering in API queries and repo access checks, merged 2026-05-18, backport 37773 to 1.26.2 — the May 2026 unification pass for public-only token filtering, reporter Medoedus per the 1.26.2 release notes, the public-only PAT scope is...

PT-2026-63310

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.4 Description An authenticated user can use a specific API endpoint as a cross-repository label-ID existence and enumeration oracle. This occurs because the system performs a global, unscoped lookup of labels by ID...

Gitea: Public-only API token restriction is not enforced on team API routes

Gitea's /api/v1/teams/id API routes do not correctly enforce the public-only access token restriction. A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata and...

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup DeleteCollaboration removes the collaboration record, recalculates accesses, drops watches, and unassigns issues — but it...

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

This is a cross-repository IDOR / broken access control issue. An attacker can tamper with issue-tracking state dependency relationships and inject an attacker-authored comment into a private repository they cannot otherwise read or write to, crossing a trust boundary the "add" path explicitly...