github.com/go-gitea/gitea vulnerabilities (Go)

20 vulnerabilities.

• github.com/go-gitea/gitea Go Gitea redirect handling permits open redirects through backslash paths CVE-2026-25779 Fix available 6.1 MediumJune 17, 2026
• github.com/go-gitea/gitea Go Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure CVE-2026-20912 Fix available 9.1 CriticalJanuary 22, 2026
• github.com/go-gitea/gitea Go Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes CVE-2026-20904 Fix available 6.5 MediumJanuary 22, 2026
• github.com/go-gitea/gitea Go Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) CVE-2026-20897 Fix available 9.1 CriticalJanuary 22, 2026
• github.com/go-gitea/gitea Go Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass) CVE-2026-20888 Fix available 4.3 MediumJanuary 22, 2026
• github.com/go-gitea/gitea Go Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure CVE-2026-20883 Fix available 6.5 MediumJanuary 22, 2026
• github.com/go-gitea/gitea Go Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation CVE-2026-20800 Fix available 6.5 MediumJanuary 22, 2026
• github.com/go-gitea/gitea Go Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR) CVE-2026-20750 Fix available 9.1 CriticalJanuary 22, 2026
• github.com/go-gitea/gitea Go Gitea vulnerable to Argument Injection CVE-2022-42968 Fix available 9.8 CriticalOctober 16, 2022
• github.com/go-gitea/gitea Go Cross-site Scripting in Gitea CVE-2021-45329 Fix available 6.1 MediumFebruary 8, 2022
• github.com/go-gitea/gitea Go Open redirect in Gitea CVE-2021-45328 Fix available 6.1 MediumFebruary 8, 2022
• github.com/go-gitea/gitea Go Capture-replay in Gitea CVE-2021-45327 Fix available 9.8 CriticalFebruary 8, 2022
• github.com/go-gitea/gitea Go Cross Site Request Forgery in Gitea CVE-2021-45326 Fix available 8.8 HighFebruary 8, 2022
• github.com/go-gitea/gitea Go Gitea displaying raw OpenID error in UI CVE-2021-45325 Fix available 7.5 HighFebruary 8, 2022
• github.com/go-gitea/gitea Go Buffer Overflow in gitea CVE-2021-3382 Fix available 7.5 HighFebruary 5, 2021
• github.com/go-gitea/gitea Go Improper Access Control in Gitea CVE-2020-28991 Fix available 9.8 CriticalNovember 24, 2020
• github.com/go-gitea/gitea Go Denial of Service in Gitea CVE-2020-13246 Fix available 7.5 HighMay 20, 2020
• github.com/go-gitea/gitea Go Gitea Remote Code Execution CVE-2019-11229 Public exploitFix available EPSS 55.0% 8.8 HighApril 13, 2019
• github.com/go-gitea/gitea Go Gitea Improper Input Validation CVE-2019-11228 Fix available 7.5 HighApril 13, 2019
• github.com/go-gitea/gitea Go Gitea Exposes Private Email Addresses CVE-2018-1000803 Fix available 5.3 MediumOctober 8, 2018