code.gitea.io/gitea vulnerabilities (Go)
124 vulnerabilities.
-
code.gitea.io/giteaGo Gitea: Remote Code Execution via diffpatch Git Hook Installation 9.8 Critical -
code.gitea.io/giteaGo Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints 4.9 Medium -
code.gitea.io/giteaGo SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata 7.5 High -
code.gitea.io/giteaGo Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass 8.3 High -
code.gitea.io/giteaGo Webhook Authorization Header Returned in Plaintext via API 2.7 Low -
code.gitea.io/giteaGo Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs 6.5 Medium -
code.gitea.io/giteaGo GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private 4.3 Medium -
code.gitea.io/giteaGo Two SSRF findings in Gitea 1.26.2 7.7 High -
code.gitea.io/giteaGo ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests 7.5 High -
code.gitea.io/giteaGo Gitea SSH Key Parser Denial of Service 6.2 Medium -
code.gitea.io/giteaGo Repository Visibility Manipulation via Git Push Options 7.1 High -
code.gitea.io/giteaGo OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) 8.1 High -
code.gitea.io/giteaGo Gitea LFS Deploy-Key Privilege Escalation 5.4 Medium -
code.gitea.io/giteaGo Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service 2.7 Low -
code.gitea.io/giteaGo OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes 9.1 Critical -
code.gitea.io/giteaGo Private Repository Metadata Remains Accessible After Access Revocation 7.5 High -
code.gitea.io/giteaGo Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) 7.5 High -
code.gitea.io/giteaGo RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) 4.3 Medium -
code.gitea.io/giteaGo Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint 6.5 Medium -
code.gitea.io/giteaGo Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API 2.7 Low -
code.gitea.io/giteaGo Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents 4.3 Medium -
code.gitea.io/giteaGo Public-only repository tokens can update private PR head branches 9.1 Critical -
code.gitea.io/giteaGo Repository migration SSRF via multi-answer DNS allow-list bypass 6.5 Medium -
code.gitea.io/giteaGo SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL 6.3 Medium -
code.gitea.io/giteaGo Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions 5.3 Medium -
code.gitea.io/giteaGo Privilege Escalation via Access Token Scope Escalation in API 9.8 Critical -
code.gitea.io/giteaGo Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload 6.2 Medium -
code.gitea.io/giteaGo Private Repository Existence Disclosure via go-get Meta Endpoint 5.3 Medium -
code.gitea.io/giteaGo Cross-repository issue/comment attachment re-linking can expose private attachment content 5.9 Medium -
code.gitea.io/giteaGo Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim 3.1 Low -
code.gitea.io/giteaGo OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) 4.3 Medium -
code.gitea.io/giteaGo Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads 4.3 Medium -
code.gitea.io/giteaGo Gitea Remember-Me Token Theft Not Invalidating Attacker Session 9.1 Critical -
code.gitea.io/giteaGo Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in c… 5.9 Medium -
code.gitea.io/giteaGo Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) 6.5 Medium -
code.gitea.io/giteaGo Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 9.6 Critical -
code.gitea.io/giteaGo Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag 8.1 High -
code.gitea.io/giteaGo Gitea private repository metadata disclosure after access revocation 4.3 Medium -
code.gitea.io/giteaGo Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration 8.5 High -
code.gitea.io/giteaGo Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write 9.6 Critical -
code.gitea.io/giteaGo Permanent Fork PR Workflow Approval Gate Bypass 8.9 High -
code.gitea.io/giteaGo LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories 7.7 High -
code.gitea.io/giteaGo Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts 9.8 Critical -
code.gitea.io/giteaGo Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service 7.5 High -
code.gitea.io/giteaGo Notification API leaks private issue metadata after access revocation 7.5 High -
code.gitea.io/giteaGo SSRF via HTTP Redirect in Repository Migration 6.5 Medium -
code.gitea.io/giteaGo Gitea LFS object reuse bypasses Code-unit authorization 7.1 High -
code.gitea.io/giteaGo Gitea repository dumps write release assets using unsafe path names 5.3 Medium -
code.gitea.io/giteaGo Gitea pre-receive hook can miss branch-protection checks after scanner errors 9.8 Critical -
code.gitea.io/giteaGo Gitea forwarded-proto handling allows public URL spoofing 7.5 High - Show olderLoading…