CVE-2026-110311

Creating a draft release through the API returned an assets list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata file name, UUID, upload time, size...

CVE-2026-97859 Gitea API disclosure of private user social graph, keys and stars

Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

CVE-2026-97859 Gitea API disclosure of private user social graph, keys and stars

Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

CVE-2026-97859

The Gitea platform contains a vulnerability where seven API routes under /api/v1/users/{username} (including followers, following, starred, subscriptions, and keys) were registered without the individualPermsChecker middleware. This oversight allows an authenticated user to access the social grap...

EUVD-2026-103993

Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

CVE-2026-97859

Seven Gitea API routes under "/api/v1/users/username" followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the "individualPermsChecker" middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

CVE-2026-97859 Gitea API disclosure of private user social graph, keys and stars

Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

CVE-2026-110311

Creating a draft release through the API returned an "assets" list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata file name, UUID, upload time, si...

EUVD-2026-103989

Creating a draft release through the API returned an assets list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata file name, UUID, upload time, size...

CVE-2026-109844 Gitea watched repositories API disclosure after access revocation

GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its...

CVE-2026-109844 Gitea watched repositories API disclosure after access revocation

GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its...

CVE-2026-109844 Gitea watched repositories API disclosure after access revocation

GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its...

CVE-2026-109844

"GET /api/v1/user/subscriptions" returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read i...

CVE-2026-109844

The Gitea repository management platform is affected by a vulnerability where the GET /api/v1/user/subscriptions endpoint fails to verify if a user still maintains access to a watched repository. Consequently, a user who previously had access to a private repository but subsequently lost those pe...

EUVD-2026-103988

GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its...

CVE-2026-109553

The Gitea Git repository management system is vulnerable to unauthorized access due to a flaw in the VerifyCert() function. The system incorrectly resolves SSH certificate principals by searching the content of all stored public keys instead of only the principal keys. If Gitea is configured to t...

CVE-2026-109553 Gitea SSH certificate principal impersonation of other users

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...

CVE-2026-109553 Gitea SSH certificate principal impersonation of other users

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...

CVE-2026-109553 Gitea SSH certificate principal impersonation of other users

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...

Ekko

Ekko A small sleep obfuscation technique that uses CreateTimerQueueTimer Win32 API. Proof of Concept. Can be done better. NOTE This implementation has known flawes. So I wouldn't recommend using it without knowing how it works or know how to spot and fix those flaws. TLDR: don't copy and past it...