CVE-2026-23603

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

3.1 LowFix available

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.29%Up 0.1 points since Aug 14, 2026

What each source reports

CVE List Score used 3.1

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Record: CVE-2026-23603
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2026-58134 3.1

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Record: EUVD-2026-58134
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-x77v-q46j-393g 3.1

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Summary

When [oauth2_client] UPDATE_AVATAR = true is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go's default HTTP client. The URL comes from the user's OAuth/OIDC avatar value, commonly the OIDC picture claim.

The affected code path calls http.Get(url) without applying outbound host or IP restrictions. A low-privileged user who can influence their own picture claim under an already-configured OAuth2/OIDC source can cause the Gitea server to make arbitrary outbound HTTP GET requests. This includes requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as 169.254.169.254.

This is a blind SSRF by default. Impact can increase in deployments where the Gitea host can reach cloud metadata services, localhost-only services, or internal services that return valid image data.

Details

The vulnerable sink is in routers/web/auth/oauth.go:

func oauth2UpdateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) {
    if setting.OAuth2Client.UpdateAvatar && len(url) > 0 {
        resp, err := http.Get(url)
        if err == nil {
            defer func() { _ = resp.Body.Close() }()
        }
        if err == nil && resp.StatusCode == http.StatusOK {
            data, err := io.ReadAll(io.LimitReader(resp.Body, setting.Avatar.MaxFileSize+1))
            if err == nil && int64(len(data)) <= setting.Avatar.MaxFileSize {
                _ = user_service.UploadAvatar(ctx, u, data)
            }
        }
    }
}

The caller is in routers/web/auth/oauth_signin_sync.go:

func oauth2SignInSync(ctx *context.Context, authSourceID int64, u *user_model.User, gothUser goth.User) {
    oauth2UpdateAvatarIfNeed(ctx, gothUser.AvatarURL, u)
    ...
}

gothUser.AvatarURL is derived from the OAuth2/OIDC provider's avatar value. For OIDC providers, this is commonly populated from the picture claim returned by the provider's userinfo endpoint or ID token.

The issue is that this value can be attacker-influenced in some common IdP configurations, while Gitea fetches it server-side using http.Get with no host/IP validation and no restricted transport.

Comparable outbound fetch paths in Gitea use hostmatcher.NewDialContext to enforce restrictions at TCP dial time. For example, repository migration uses an HTTP transport with host matching. The OAuth2 avatar synchronization path does not apply those restrictions.

PoC

Requirements

Local Gitea build or binary
Python 3
Python packages: requests, pyjwt, cryptography
Gitea configured with OAuth2 avatar synchronization enabled

Install Python dependencies:

python3 -m pip install requests pyjwt cryptography

Configure app.ini:

[oauth2_client]
UPDATE_AVATAR = true
ENABLE_AUTO_REGISTRATION = true
USERNAME = userid

Run the fake OIDC provider:

python3 fake_oidc.py http://127.0.0.1:8888/ 9999

Run a listener for the SSRF target:

nc -lvnp 8888

Provider: OpenID Connect
Client ID: gitea-client
Client Secret: gitea-secret
OpenID Connect Auto Discovery URL: http://127.0.0.1:9999/.well-known/openid-configuration

Then initiate login through the configured OAuth2 source.

Observed request to the SSRF listener:

GET / HTTP/1.1
Host: 127.0.0.1:8888
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip

Observe that Gitea fetched the OIDC picture claim URL from the server side using the default Go HTTP client.

Impact

When [oauth2_client] UPDATE_AVATAR = true is enabled, a low-privileged OAuth2/OIDC user who can influence their own picture claim can force the Gitea server to make outbound HTTP GET requests to attacker-selected URLs. This allows blind SSRF from the Gitea server’s network position, including requests to loopback addresses, RFC1918 private addresses, link-local addresses such as 169.254.169.254, and other…

Record: GHSA-x77v-q46j-393g
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 3.1

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Record: CVE-2026-23603
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSV 3.1

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Record: CVE-2026-23603
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSVGHSA-x77v-q46j-393g 3.1

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Summary

This is a blind SSRF by default. Impact can increase in deployments where the Gitea host can reach cloud metadata services, localhost-only services, or internal services that return valid image data.

Details

The vulnerable sink is in routers/web/auth/oauth.go:

func oauth2UpdateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) {
    if setting.OAuth2Client.UpdateAvatar && len(url) > 0 {
        resp, err := http.Get(url)
        if err == nil {
            defer func() { _ = resp.Body.Close() }()
        }
        if err == nil && resp.StatusCode == http.StatusOK {
            data, err := io.ReadAll(io.LimitReader(resp.Body, setting.Avatar.MaxFileSize+1))
            if err == nil && int64(len(data)) <= setting.Avatar.MaxFileSize {
                _ = user_service.UploadAvatar(ctx, u, data)
            }
        }
    }
}

The caller is in routers/web/auth/oauth_signin_sync.go:

func oauth2SignInSync(ctx *context.Context, authSourceID int64, u *user_model.User, gothUser goth.User) {
    oauth2UpdateAvatarIfNeed(ctx, gothUser.AvatarURL, u)
    ...
}

The issue is that this value can be attacker-influenced in some common IdP configurations, while Gitea fetches it server-side using http.Get with no host/IP validation and no restricted transport.

PoC

Requirements

Local Gitea build or binary
Python 3
Python packages: requests, pyjwt, cryptography
Gitea configured with OAuth2 avatar synchronization enabled

Install Python dependencies:

python3 -m pip install requests pyjwt cryptography

Configure app.ini:

[oauth2_client]
UPDATE_AVATAR = true
ENABLE_AUTO_REGISTRATION = true
USERNAME = userid

Run the fake OIDC provider:

python3 fake_oidc.py http://127.0.0.1:8888/ 9999

Run a listener for the SSRF target:

nc -lvnp 8888

Provider: OpenID Connect
Client ID: gitea-client
Client Secret: gitea-secret
OpenID Connect Auto Discovery URL: http://127.0.0.1:9999/.well-known/openid-configuration

Then initiate login through the configured OAuth2 source.

Observed request to the SSRF listener:

GET / HTTP/1.1
Host: 127.0.0.1:8888
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip

Observe that Gitea fetched the OIDC picture claim URL from the server side using the default Go HTTP client.

Impact

Record: GHSA-x77v-q46j-393g
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

Show 4 moreShow less

OSVGO-2026-6083 No score

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim in gitea.dev

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim in gitea.dev

Record: GO-2026-6083
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21551-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: openSUSE-SU-2026:21551-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23216-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: SUSE-SU-2026:23216-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23227-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: SUSE-SU-2026:23227-1
Updated: 2026-11-02

Affected products

gitea open source git server

Affected packages

Affected packages
Package	Affected	Fixed
`code.gitea.io/gitea` Go	before 1.27.0	1.27.0
`gitea.dev` Go	before 1.27.0	1.27.0
`govulncheck-vulndb` SUSE:Linux Enterprise Server 16.0 From an advisory covering 77 CVEs	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1
`govulncheck-vulndb` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 77 CVEs	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1
`govulncheck-vulndb` openSUSE:Leap 16.0 From an advisory covering 77 CVEs	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-23603 is a low vulnerability (CVSS 3.1) in Gitea Open Source Git Server, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in code.gitea.io/gitea 1.27.0.

References

Show 84 moreShow less

This page doesn't list everything

Left out here: the rest of 5 source descriptions. The JSON record has them.