34884 matches found
CVE-2026-58510
The Gitea platform is affected by a vulnerability where the ClearRepoWatches fix was not applied to the API EditRepo path. This issue occurs because a sister code path retains stale watches when a repository's visibility is changed from public to private . This exposure of sensitive information t...
EUVD-2026-58171
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-58443 Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches...
CVE-2026-58443 Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches...
CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...
CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...
CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...
CVE-2026-58440
The Git repository management system Gitea is affected by an improper access control vulnerability within the DeleteCollaboration function in services/repository/collaboration.go. Due to incomplete revocation cleanup, webhooks created by a collaborator continue to fire even after their repository...
CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...
CVE-2026-58433
The Git repository management system Gitea contains a vulnerability in its team-repository linking endpoint . This flaw allows an attacker to bypass the RepoAdminChangeTeamAccess organization setting, which is designed to restrict repository administrators from modifying team access. Exploiting t...
CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...
CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...
CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...
CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...
CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...
CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
CVE-2026-58416
The Gitea git repository management system contains a vulnerability in the Fork-PR Actions task where it can be exploited to read data from a third private repository. This is caused by a missing guard preventing unauthorized access via the collaborative-owner branch . A remote attacker could lev...
CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...