ROS-20260224-73-0025

Vulnerability in gitea related to access control flaws. Exploitation of the vulnerability could allow an attacker to escalate their privileges...

ROS-20260224-73-0032

A vulnerability in the Gitea Git repository management system is related to access control errors. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to protected information...

ROS-20260224-73-0030

Vulnerability in gitea related to access control flaws. Exploitation of the vulnerability could allow an attacker to escalate their privileges...

ROS-20260224-73-0031

Vulnerability in gitea related to access control flaws. Exploitation of the vulnerability could allow an attacker to escalate their privileges...

ROS-20260224-73-0036

Vulnerability in gitea related to improper alternate path protection. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

ROS-20260224-73-0027

Vulnerability in gitea related to access control flaws. Exploitation of the vulnerability could allow an attacker to escalate their privileges...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: mattermost, keda, beats-fips, dgraph, ory-kratos, gitea, loki, terragrunt-fips, rekor-fips, vault, hydra-fips, prometheus-mysqld-exporter, nri-mysql-fips, envoy-gateway-fips, k3s, timestamp-authority, argo-workflows-fips, croc, witness, tkn-fips, spire-server-fips,...

The vulnerability of the Git repository management system Gitea, related to access control errors, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Git repository management system Gitea is related to access control errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Exploit for OS Command Injection in Gitea

Gitea Git Hooks RCE CVE-2020-14144 OffsecProvingGrounds P...

SUSE CVE-2026-0798

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags,...

SUSE CVE-2026-20736

Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access...

SUSE CVE-2026-20750

Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization...

SUSE CVE-2026-20800

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications...

SUSE CVE-2026-20883

Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches...

SUSE CVE-2026-20888

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users...

SUSE CVE-2026-20897

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories...

SUSE CVE-2026-20904

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities...

SUSE CVE-2026-20912

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users...

GO-2026-4369 Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea...

GO-2026-4368 Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea...