2953 matches found
CVE-2026-58436
A flaw was found in Gitea. An unauthenticated remote attacker could exploit a quadratic-time algorithm in the ParseAcceptLanguage function, specifically within the Locale middleware. This vulnerability allows an attacker to send specially crafted requests, leading to excessive resource consumptio...
CVE-2026-56750
A flaw was found in Gitea. An attacker who steals a user's "Remember Me" token can maintain unauthorized access to the user's account. This occurs because the system fails to invalidate the attacker's session even after the legitimate user logs out or changes their password. This vulnerability ca...
CVE-2026-56654
A flaw was found in Gitea. This vulnerability allows an attacker to escalate their privileges by manipulating the scope of an access token within the API. This means an attacker could gain unauthorized access to sensitive functions or data, potentially leading to full control over affected...
ROS-20260820-73-0003
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260820-73-0004
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260820-73-0002
The vulnerability in Gitea is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
Security update for gitea-tea (important)
openSUSE security update: security update for gitea-tea ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21603-1 Rating: important References: bsc1234598 bsc1235367 bsc1239493 bsc1241819 bsc1251471 bsc1251663 bsc1253576 Cross-References: CVE-2024-453...
CVE-2026-58438
A flaw was found in Gitea. This vulnerability, identified as an Insecure Direct Object Reference IDOR, exists within the issue-dependency removal function. A remote attacker with write access to issues in one repository can exploit this flaw to remove a dependency link to an issue in a private...
CVE-2026-58440
A flaw was found in Gitea. Webhooks created by a collaborator continue to function even after their repository access is revoked. This incomplete revocation allows for the ongoing, real-time exfiltration of private repository content, leading to information disclosure. Mitigation To mitigate this...
CVE-2026-55987
A flaw was found in Gitea. An attacker can reactivate an administrator-deactivated account by signing in via OAuth2, specifically when using authentication sources that do not utilize refresh tokens. This bypasses intended security controls, allowing unauthorized access to previously deactivated...
CVE-2026-55984
A flaw was found in Gitea. An authenticated attacker could exploit a null pointer dereference within the AddTime API. This can lead to a denial of service DoS, making the application unavailable to legitimate users...
VulnCheck KEV: CVE-2026-60004
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account...
OPENSUSE-SU-2026:21603-1 Security update for gitea-tea
This update for gitea-tea fixes the following issues: Changes in gitea-tea: - Update to 0.15.1, bringing in the 0.14.2/0.15.0/0.15.1 upstream changes below bsc1253576: CVE-2025-47913: golang.org/x/crypto/ssh/agent client process termination on an unexpected response to a key listing or signing...
CVE-2026-58417
A flaw was found in Gitea. The REST API improperly exposes the organization membership of private organizations to public users. This allows an unauthenticated remote attacker to gain unauthorized access to sensitive organizational structure information, leading to information disclosure...
Gitea 1.27.0 diffpatch Remote Code Execution
Gitea version 1.27.0 and below contains a remote code execution vulnerability in the diffpatch API. An authenticated attacker with repository write access can submit the same specially crafted patch multiple times to trigger Git's three-way merge fallback and cause an executable post-index-change...
ANT-2026-VN61PHA0 · gitea · IDOR
idor medium CVE-2026-58435 GHSA-rh79-75qm-gwjr Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-VN61PHA0: Gitea LFS Deploy-Ke...
FreeBSD : gitea -- Multiple vulnerabilities (2f3568eb-999e-11f1-a655-3497f65b111b)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2f3568eb-999e-11f1-a655-3497f65b111b advisory. Gitea reports This release contains fixes for 45 security issues, including privilege...
CVE-2026-46603 vulnerabilities
Vulnerabilities for packages: mattermost-fips, seaweedfs-operator, mailpit-fips, gitea, rclone-fips, kubescape-server-fips, nemo, mailpit, ollama-fips, ollama, kubescape, rclone, kitty, fortio-fips, seaweedfs-rocksdb-fips, pdfcpu, mattermost, seaweedfs-operator-fips, bento, gitea-fips, bento-fips...
