CVE-2021-45326
Cross Site Request Forgery in Gitea
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
- Record
CVE-2021-45326- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
- Record
CVE-2021-45326- Updated
- 2026-11-02
EUVDEUVD-2022-0822 No score
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
- Record
EUVD-2022-0822- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4wp3-8q92-mh8w
Cross Site Request Forgery in Gitea
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
- Record
GHSA-4wp3-8q92-mh8w- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-45326
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
- Record
ALPINE-CVE-2021-45326- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
- Record
CVE-2021-45326- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-4wp3-8q92-mh8w
Cross Site Request Forgery in Gitea
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
- Record
GHSA-4wp3-8q92-mh8w- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-45326
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
- Record
UBUNTU-CVE-2021-45326- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-gitea-2021-45326 No score
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
- Record
BIT-gitea-2021-45326- Updated
- 2026-11-02
OSVGO-2022-0309 No score
Cross Site Request Forgery in Gitea in github.com/go-gitea/gitea
Cross Site Request Forgery in Gitea in github.com/go-gitea/gitea
- Record
GO-2022-0309- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/go-gitea/giteaGo |
before 1.5.2 | 1.5.2 |
giteaAlpine:v3.16 |
before 1.5.2-r0 | 1.5.2-r0 |
giteaAlpine:v3.17 |
before 1.5.2-r0 | 1.5.2-r0 |
giteaAlpine:v3.18 |
before 1.5.2-r0 | 1.5.2-r0 |
giteaAlpine:v3.19 |
before 1.5.2-r0 | 1.5.2-r0 |
giteaAlpine:v3.20 |
before 1.5.2-r0 | 1.5.2-r0 |
giteaAlpine:v3.21 |
before 1.5.2-r0 | 1.5.2-r0 |
giteaAlpine:v3.22 |
before 1.5.2-r0 | 1.5.2-r0 |
giteaAlpine:v3.23 |
before 1.5.2-r0 | 1.5.2-r0 |
giteaAlpine:v3.24 |
before 1.5.2-r0 | 1.5.2-r0 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
giteaBitnami |
before 1.5.2 | 1.5.2 |
golang-code.gitea-gitUbuntu:18.04:LTS |
All versions, plus listed versions 0.0~git20170710.0.fc63966-10.0~git20170919.0.cdb43f0-10.0~git20171222.4ec3654-10.0~git20171222.4ec3654-3 |
None known |
golang-code.gitea-sdkUbuntu:18.04:LTS |
All versions, plus listed versions 0.0~git20170708.0.9990008-10.0~git20170920.0.60c6048-10.0~git20171220.79eee8f-10.0~git20171220.79eee8f-3 |
None known |
golang-code.gitea-gitUbuntu:20.04:LTS |
All versions, plus listed versions 0.0~git20171222.4ec3654-3 |
None known |
golang-code.gitea-sdkUbuntu:20.04:LTS |
All versions, plus listed versions 0.0~git20171220.79eee8f-3 |
None known |
golang-code.gitea-gitUbuntu:22.04:LTS |
All versions, plus listed versions 0.0~git20190411.63b74d4+ds-1 |
None known |
golang-code.gitea-sdkUbuntu:22.04:LTS |
All versions, plus listed versions 0.0~git20171220.79eee8f-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-45326 is a high vulnerability (CVSS 8.8) in Gitea, published February 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in github.com/go-gitea/gitea 1.5.2.
References
blog.gitea.io/2018/10/gitea-1.5.2-is-released
github.com/go-gitea/gitea/pull/4840
nvd.nist.gov/vuln/detail/CVE-2021-45326
security.alpinelinux.org/vuln/CVE-2021-45326
ubuntu.com/security/CVE-2021-45326
cve.org/CVERecord?id=CVE-2021-45326