gitea.dev vulnerabilities (Go)
45 vulnerabilities.
-
gitea.devGo Gitea: Remote Code Execution via diffpatch Git Hook Installation 9.8 Critical -
gitea.devGo Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints 4.9 Medium -
gitea.devGo SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata 7.5 High -
gitea.devGo Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass 8.3 High -
gitea.devGo Webhook Authorization Header Returned in Plaintext via API 2.7 Low -
gitea.devGo Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs 6.5 Medium -
gitea.devGo GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private 4.3 Medium -
gitea.devGo Public-only API token restriction is not enforced on team API routes 4.3 Medium -
gitea.devGo Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 7.5 High -
gitea.devGo Two SSRF findings in Gitea 1.26.2 7.7 High -
gitea.devGo ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests 7.5 High -
gitea.devGo Gitea SSH Key Parser Denial of Service 6.2 Medium -
gitea.devGo Repository Visibility Manipulation via Git Push Options 7.1 High -
gitea.devGo OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) 8.1 High -
gitea.devGo Gitea LFS Deploy-Key Privilege Escalation 5.4 Medium -
gitea.devGo Local File Inclusion via file:// URI in Migration Restore 4.4 Medium -
gitea.devGo Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service 2.7 Low -
gitea.devGo OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes 9.1 Critical -
gitea.devGo Private Repository Metadata Remains Accessible After Access Revocation 7.5 High -
gitea.devGo Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) 7.5 High -
gitea.devGo REST API exposes organization membership of private organizations to public 7.5 High -
gitea.devGo RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) 4.3 Medium -
gitea.devGo Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) 7.1 High -
gitea.devGo Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint 6.5 Medium -
gitea.devGo Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API 2.7 Low -
gitea.devGo Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents 4.3 Medium -
gitea.devGo Public-only repository tokens can update private PR head branches 9.1 Critical -
gitea.devGo Repository migration SSRF via multi-answer DNS allow-list bypass 6.5 Medium -
gitea.devGo SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL 6.3 Medium -
gitea.devGo Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access 7.5 High -
gitea.devGo Privilege Escalation via Access Token Scope Escalation in API 9.8 Critical -
gitea.devGo Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload 6.2 Medium -
gitea.devGo Private Repository Existence Disclosure via go-get Meta Endpoint 5.3 Medium -
gitea.devGo Cross-repository issue/comment attachment re-linking can expose private attachment content 5.9 Medium -
gitea.devGo Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim 3.1 Low -
gitea.devGo OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) 4.3 Medium -
gitea.devGo Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads 4.3 Medium -
gitea.devGo Gitea Remember-Me Token Theft Not Invalidating Attacker Session 9.1 Critical -
gitea.devGo Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in c… 5.9 Medium -
gitea.devGo Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) 6.5 Medium -
gitea.devGo Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 9.6 Critical -
gitea.devGo Gitea private repository metadata disclosure after access revocation 4.3 Medium -
gitea.devGo Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`) 6.8 Medium -
gitea.devGo Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration 8.5 High -
gitea.devGo Gitea LFS object reuse bypasses Code-unit authorization 7.1 High