124 matches found
CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass
Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...
Exploit for CVE-2026-60004
CVE-2026-60004 — Gitea Pre-Auth Remote Code Execution CVSS 9...
SUSE CVE-2026-20896
Gitea Docker image versions up to and including 1.26.2 use REVERSEPROXYTRUSTEDPROXIES= by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled...
PT-2026-65725
Name of the Vulnerable Software and Affected Versions Gitea versions 1.17.0 through 1.27.0 Description A critical code injection issue exists in the diffpatch API endpoint. An attacker with write access to a repository can exploit this by submitting a specially crafted patch twice, triggering an...
GO-2026-6085 Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev
Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev...
ROS-20260727-73-0018
A vulnerability in Gitea related to insufficient validation of incoming requests. Exploitation of this vulnerability could allow a remote attacker to carry out an SSRF attack...
GO-2026-6039 Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev...
GO-2026-6043 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea...
CVE-2026-42931
creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:52+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-wwqq-x6w4-frm2 2026-08-14 12:45:12+00:00| seen|...
GHSA-FQ2P-5P22-8G6J Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such tokens are limited to public...
Improper Restriction of Security Token Assignment
Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...
EUVD-2026-41636
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write...
GHSA-FW57-JGCH-PGF3 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Summary The Locale middleware that runs in front of every unauthenticated request calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing a size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language...
GHSA-JR5X-6H83-WRXF Gitea: REST API exposes organization membership of private organizations to public
Summary The endpoint "/orgs/org/publicmembers/username" + GET exposes organization membership of public members in a private organization. PoC 1. Spin up the nightly container of Gitea. 2. Perform the default installation. 3. Register a new user let's call this user "user1". 4. Create a new...
GHSA-CP3Q-VRJ2-GHHH Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Summary A personal access token PAT or OAuth2 token that does not carry the repository scope or that is public-only is correctly rejected HTTP 403 by the recently hardened web content routes archive download, raw/media file download, and repository RSS/Atom feeds. However, the repository home pag...
Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
Summary After PR 37118 / CVE-2026-25714 fix: Unify public-only token filtering in API queries and repo access checks, merged 2026-05-18, backport 37773 to 1.26.2 — the May 2026 unification pass for public-only token filtering, reporter Medoedus per the 1.26.2 release notes, the public-only PAT...
PT-2026-63282
Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description A bypass exists for the public-only Personal Access Token PAT scope when the owner's visibility is set to Limited instance-internal. While other scope categories correctly reject Limited owners, the Repository...
ROS-20260714-73-0071
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260714-73-0075
The vulnerability in Gitea is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...