CVE-2026-58314

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:23+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-2fcr-jfvc-vgg2...

CVE-2026-24451

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:20+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-wrf9-r3h7-7x5v...

CVE-2026-25038

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:18+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-v73x-hx65-6pf4...

CVE-2026-58427

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:14+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-prr9-9mp4-5gp2 2026-08-15 18:03:40+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mt5b2vwwe22o 2026-08-15...

CVE-2026-58431

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:11+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-h56g-4qw7-2mxg...

CVE-2026-59765

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:07+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc...

CVE-2026-58429

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:05+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-fq2p-5p22-8g6j...

EUVD-2026-41613

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...

GHSA-FQ2P-5P22-8G6J Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such tokens are limited to public...

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such tokens are limited to public...

Improper Restriction of Security Token Assignment

Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...