2044 matches found
GHSA-HGR3-X44X-33HX Gitea has improper access control for uploaded attachments
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access...
Gitea has improper access control for uploaded attachments
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access...
Gitea does not properly validate project ownership in organization project operations
Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization...
Gitea does not properly validate repository ownership when deleting Git LFS locks
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories...
GHSA-J8XR-C56Q-M8JJ Gitea improperly exposes issue titles and repository names through previously started stopwatches
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via the release notification process. An attacker can receive unauthorized information about private repository releases by maintaining a watch on a repository that was changed from public to private, even after...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via improper validation of repository ownership in the delete process for Git LFS locks. An attacker can remove LFS locks from repositories they do not own by leveraging write access to a...
GHSA-9CGQ-WP42-4RPQ Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the web interface when canceling scheduled auto-merges. An attacker can terminate auto-merges scheduled by other users by leveraging read access to pull requests. Remediation Upgrade...
EUVD-2026-4270
Gitea may send release notification emails for private repositories to users whose access has been revoked...
EUVD-2026-4265
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface...
Gitea improperly exposes issue and pull request titles
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications...
Gitea improperly exposes issue titles and repository names through previously started stopwatches
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches...
EUVD-2026-4269
Gitea has improper access control for uploaded attachments...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via improper verification of repository context during the deletion process. An attacker can remove attachments they previously uploaded to a repository, even after losing access to that...
EUVD-2026-4267
Gitea improperly exposes issue titles and repository names through previously started stopwatches...
EUVD-2026-4264
Gitea does not properly validate repository ownership when deleting Git LFS locks...
GHSA-393C-QGVJ-3XPH Gitea does not properly validate repository ownership when deleting Git LFS locks
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories...
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users...