GO-2026-6059 Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev

Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev...

GO-2026-6084 Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL in gitea.dev

Gitea: SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL in gitea.dev...

GO-2026-6072 Gitea Remember-Me Token Theft Not Invalidating Attacker Session in gitea.dev

Gitea Remember-Me Token Theft Not Invalidating Attacker Session in gitea.dev...

GO-2026-6073 Gitea LFS Deploy-Key Privilege Escalation in gitea.dev

Gitea LFS Deploy-Key Privilege Escalation in gitea.dev...

GO-2026-6035 Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content in gitea.dev

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content in gitea.dev...

GO-2026-6038 Gitea: Two SSRF findings in gitea.dev

Gitea: Two SSRF findings in gitea.dev...

GO-2026-6048 Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override in gitea.dev

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override in gitea.dev...

GO-2026-6042 Gitea SSH Key Parser Denial of Service in gitea.dev

Gitea SSH Key Parser Denial of Service in gitea.dev...

GO-2026-6033 Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content in gitea.dev

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content in gitea.dev...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via a malformed SSH sub-verb in the authentication process. An attacker can gain unauthorized read access to private repositories by crafting specific SSH requests. Remediation Upgrade gitea.dev/cmd to version...