CVE-2026-104626 Gitea fork workflow job revival through later approval

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer...

CVE-2026-104626 Gitea fork workflow job revival through later approval

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer...

EUVD-2026-93906

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-103059

A flaw in Gitea allows an authentication bypass when the built-in SSH server is enabled (START_SSH_SERVER = true). The root cause is the use of an SQL LIKE comparison for looking up public keys, which is case-insensitive on certain databases like SQLite . An attacker who can construct a case vari...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-104632 Gitea fork workflow approval bypass through cancel and rerun

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

CVE-2026-104632

Gitea Actions contains a vulnerability where workflow jobs from first-time fork pull request contributors can bypass the required maintainer approval. The root cause is that the rerun path only checks if a run is finished and builds new jobs without verifying the pending approval status. An attac...

EUVD-2026-93905

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

CVE-2026-104632 Gitea fork workflow approval bypass through cancel and rerun

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

CVE-2026-104632 Gitea fork workflow approval bypass through cancel and rerun

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

gitea-gogs-symlink-git-config-rce

Gitea / Gogs - Symlink .git/config Poisoning - RCE Descrip...

cve-2026-22874-gitea-ssrf-allowlist

CVE-2026-22874 — حماية غير مكتملة من SSRF في قائمة سماح webhook والترحيل في Gitea شرح فني ومراجع لـ CVE-2026-22874 GHSA-2r5c-gw76-rh3w: قائمة سماح SSRF غير مكتملة في تسليم webhook وترحيل المستودعات في Gitea، تم إصلاحها في Gitea 1.26.3. لقد أبلغتُ بشكل مستقل عن هذه الفئة من SSRF إلى القائمين على...

CVE-2026-60004-PoC

CVE-2026-60004: تنفيذ تعليمات برمجية عن بُعد عبر واجهة Gitea Diffpatch API !WARNING هذا المستودع مخصص حصريًا لأبحاث الأمن المصرّح بها والاختبار المخبري المُتحكَّم به. لا تشغّل إثبات المفهوم ضد أنظمة لا تملكها أو لا تملك إذنًا صريحًا بتقييمها. نظرة عامة CVE-2026-60004 هو ثغرة حرجة لتنفيذ تعليمات...

CVE-2026-22874-PoC

CVE-2026-22874 — Gitea SSRF PoC ⚠️ إخلاء مسؤولية : هذا الدليل التجريبي مخصص فقط للاختبار المصرح به في نسخ Gitea = 1.26.3 حالات الاستخدام القانونية بحث أمني بإذن صريح اختبار في المختبر/التطوير التحقق من صحة التخفيفات التخفيفات إذا لم تتمكن من التصحيح 1. تعطيل webhooks بالكامل 2. تنفيذ ضوابط الخروج...

Hack-The-Box-Nexus-Findings-Report

🛡️ Hack The Box - Nexus تقرير النتائج 📋 نظرة عامة يحتوي هذا المستودع على تقرير شامل لاختبار الاختراق لجهاز Hack The Box Nexus. 🔍 النتائج الرئيسية بيانات اعتماد مكشوفة في سجل الالتزامات Commit History الخاص بـ Gitea - خطورة متوسطة رفع ملفات غير مقيد في Krayin CRM CVE-2026-38526 - خطورة عالية...

PT-2026-107225

When Gitea's web installer is reachable against a database that already contains users, such as after INSTALL LOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying it...

PT-2026-107171

Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed image manifests, without a Content-Disposition or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a...

PT-2026-107290

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/push mirrors checked only whether mirroring was enabled and not the mirror DISABLE NEW PUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where...