CVE-2026-96580: Uncontrolled Resource Consumption

Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large...

PT-2026-107221

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea accepted pushed Git trees containing two entries with the same name, a condition that Git's own consistency checks typically reject. This discrepancy causes Gitea's web views to resolve t...

CVE-2026-101023: Improper Authentication

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...

CVE-2026-96404: Improper Authentication

When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...

CVE-2026-105640

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

CVE-2026-104976

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-105640 Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

CVE-2026-105640 Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

CVE-2026-105640

The open-source project management tool Plane is vulnerable to account takeover in versions prior to 1.4.0 . The root cause is that Plane trusts email addresses from Gitea OAuth and self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying provider-authenticate...

CVE-2026-105640 Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

EUVD-2026-92596

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

CVE-2026-104976 Plane: SSRF in Gitea OAuth

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

EUVD-2026-92533

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-104976 Plane: SSRF in Gitea OAuth

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-104976

The project management tool Plane is vulnerable to a Server-Side Request Forgery (SSRF) in versions prior to 1.4.0 . The application fails to reject hosts that resolve to private or internal IP addresses when validating the GITEA_HOST variable. Specifically, four outbound requests in the Gitea OA...

CVE-2026-104976 Plane: SSRF in Gitea OAuth

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-60004

CVE-2026-60004 Gitea diffpatch RCE ★ CVE-2026-60004 Gitea diffpatch Git Hook RCE PoC ★ https://github.com/user-attachments/assets/403a70f4-4ff4-4ab7-b11c-d73d70adaf0b Overview CVE-2026-60004 is a Remote Code Execution RCE vulnerability in Gitea. The diffpatch API applies a supplied patch with git...

CVE-2026-27771

CVE-2026-27771 — Gitea Container Registry Auth Bypass CVSS: N/A unpublished Affects: Gitea Disclaimer: This proof-of-concept is provided for educational and authorized security research purposes only. Unauthorized access to computer systems is illegal. The authors are not responsible for any misu...

PT-2026-106055

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-105640: Improper Authentication

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...