CVE-2026-104626

The Gitea Actions system is vulnerable to a workflow job revival flaw. A user capable of opening a fork pull request can inject workflow content using a shared run-level concurrency group into a run awaiting approval. If a subsequent run in that group cancels the blocked job, the run enters a ter...

CVE-2026-104626 Gitea fork workflow job revival through later approval

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer...

EUVD-2026-93906

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-103059

A flaw in Gitea allows an authentication bypass when the built-in SSH server is enabled (START_SSH_SERVER = true). The root cause is the use of an SQL LIKE comparison for looking up public keys, which is case-insensitive on certain databases like SQLite . An attacker who can construct a case vari...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-104632 Gitea fork workflow approval bypass through cancel and rerun

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

CVE-2026-104632

Gitea Actions contains a vulnerability where workflow jobs from first-time fork pull request contributors can bypass the required maintainer approval. The root cause is that the rerun path only checks if a run is finished and builds new jobs without verifying the pending approval status. An attac...

EUVD-2026-93905

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

CVE-2026-104632 Gitea fork workflow approval bypass through cancel and rerun

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

CVE-2026-104632 Gitea fork workflow approval bypass through cancel and rerun

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

gitea-gogs-symlink-git-config-rce

Gitea / Gogs - Symlink .git/config Poisoning - RCE Descrip...

cve-2026-22874-gitea-ssrf-allowlist

CVE-2026-22874 — Proteção SSRF incompleta na lista de permissões de webhooks e migração do Gitea Análise técnica e referências para CVE-2026-22874 GHSA-2r5c-gw76-rh3w: uma lista de permissões SSRF incompleta na entrega de webhooks e na migração de repositórios do Gitea, corrigida no Gitea 1.26.3...

CVE-2026-60004-PoC

CVE-2026-60004: Execução Remota de Código na API Diffpatch do Gitea !WARNING Este repositório destina-se exclusivamente a pesquisa de segurança autorizada e testes controlados em laboratório. Não execute a prova de conceito contra sistemas que você não possui ou para os quais não tem permissão...

CVE-2026-22874-PoC

CVE-2026-22874 — Gitea SSRF PoC ⚠️ AVISO : Este PoC é SOMENTE para testes autorizados em instâncias Gitea = 1.26.3 Casos de Uso Legais Pesquisa de segurança com autorização explícita Testes em lab/desenvolvimento Validação de mitigações Mitigações Caso Não Seja Possível Aplicar o Patch 1...

Hack-The-Box-Nexus-Findings-Report

🛡️ Hack The Box - Relatório de Descobertas Nexus 📋 Visão Geral Este repositório contém um relatório abrangente de teste de penetração para a máquina Nexus do Hack The Box. 🔍 Principais Descobertas Credenciais Expostas no Histórico de Commits do Gitea - Severidade Média Upload Irrestrito de...

PT-2026-107225

When Gitea's web installer is reachable against a database that already contains users, such as after INSTALL LOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying it...

PT-2026-107171

Gitea's container registry served blob downloads with a Content-Type taken from the media type declared in pushed image manifests, without a Content-Disposition or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a...

PT-2026-107290

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/push mirrors checked only whether mirroring was enabled and not the mirror DISABLE NEW PUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where...