Skip to contentGitea Open Source Git Server vulnerabilities
- gitea open source git serverGitea runner registration-token GET endpoint performs a write under a read-only token scopeCVE-2026-240596.5 Medium
- gitea open source git serverTwo SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)CVE-2026-585089.1 Critical
- gitea open source git serverTeam-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization settingCVE-2026-584339.1 Critical
- gitea open source git serverEmail Management API Bypasses ManageCredentials Feature RestrictionsCVE-2026-559865.4 Medium
- gitea open source git serverPublic-Only Personal access tokens scope bypass in Organization and Permission EndpointsCVE-2026-58429Fix available4.9 Medium
- gitea open source git serverSSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud MetadataCVE-2026-59765Fix available7.5 High
- gitea open source git serverWebhook Authorization Header Returned in Plaintext via APICVE-2026-58511Fix available2.7 Low
- gitea open source git serverCross-Repo Information Disclosure via Org-Level Actions Run/Job APIsCVE-2026-57897Fix available6.5 Medium
- gitea open source git serverGHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->privateCVE-2026-58510Fix available4.3 Medium
- gitea open source git serverPublic-only API token restriction is not enforced on team API routesCVE-2026-58431Fix available4.3 Medium
- gitea open source git serverPrivate org member list leaked via /members API endpoint — incomplete fix for PR #38145CVE-2026-58427Fix available7.5 High
- gitea open source git serverTwo SSRF findings in Gitea 1.26.2CVE-2026-58314Fix available7.7 High
- gitea open source git serverParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsCVE-2026-58436Fix available7.5 High
- gitea open source git serverGitea SSH Key Parser Denial of ServiceCVE-2026-56657Fix available6.2 Medium
- gitea open source git serverRepository Visibility Manipulation via Git Push OptionsCVE-2026-58437Fix available7.1 High
- gitea open source git serverOAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)CVE-2026-55987Fix available8.1 High
- gitea open source git serverGitea LFS Deploy-Key Privilege EscalationCVE-2026-58435Fix available5.4 Medium
- gitea open source git serverLocal File Inclusion via file:// URI in Migration RestoreCVE-2026-58420Fix available4.4 Medium
- gitea open source git serverNull Pointer Dereference in AddTime API Causes Authenticated Denial of ServiceCVE-2026-55984Fix available2.7 Low
- gitea open source git serverOIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token ScopesCVE-2026-55982Fix available9.1 Critical
- gitea open source git serverPrivate Repository Metadata Remains Accessible After Access RevocationCVE-2026-58434Fix available7.5 High
- gitea open source git serverInternal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)CVE-2026-54481Fix available7.5 High
- gitea open source git serverREST API exposes organization membership of private organizations to publicCVE-2026-58417Fix available7.5 High
- gitea open source git serverRSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)CVE-2026-50105Fix available4.3 Medium
- gitea open source git serverFork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)CVE-2026-58416Fix available7.1 High
- gitea open source git serverDenial of Service via Unbounded io.ReadAll in NPM Package Tag EndpointCVE-2026-42931Fix available6.5 Medium
- gitea open source git serverCross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APICVE-2026-58445Fix available2.7 Low
- gitea open source git serverPersonal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contentsCVE-2026-58444Fix available4.3 Medium
- gitea open source git serverPublic-only repository tokens can update private PR head branchesCVE-2026-58443Fix available9.1 Critical
- gitea open source git serverRepository migration SSRF via multi-answer DNS allow-list bypassCVE-2026-58442Fix available6.5 Medium
- gitea open source git serverSSRF in restore-repo via unsanitized pull_request.yml Head.CloneURLCVE-2026-58441Fix available6.3 Medium
- gitea open source git serverCross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot accessCVE-2026-58438Fix available7.5 High
- gitea open source git serverPrivilege Escalation via Access Token Scope Escalation in APICVE-2026-56654Fix available9.8 Critical
- gitea open source git serverDenial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package UploadCVE-2026-56755Fix available6.2 Medium
- gitea open source git serverPrivate Repository Existence Disclosure via go-get Meta EndpointCVE-2026-58507Fix available5.3 Medium
- gitea open source git serverCross-repository issue/comment attachment re-linking can expose private attachment contentCVE-2026-57886Fix available5.9 Medium
- gitea open source git serverBlind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claimCVE-2026-23603Fix available3.1 Low
- gitea open source git serverOAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)CVE-2026-58425Fix available4.3 Medium
- gitea open source git serverUnbounded Arch package file metadata can cause resource amplification in Gitea package uploadsCVE-2026-59763Fix available4.3 Medium
- gitea open source git serverGitea Remember-Me Token Theft Not Invalidating Attacker SessionCVE-2026-56750Fix available9.1 Critical
- gitea open source git serverMissing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in c…CVE-2026-58432Fix available5.9 Medium
- gitea open source git serverRelease attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)CVE-2026-58428Fix available6.5 Medium
- gitea open source git serverToken public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118CVE-2026-56443Fix available9.6 Critical
- gitea open source git serverBranch Protection Bypass via PR Retargeting Preserves Stale `official` Approval FlagCVE-2026-58439Fix available8.1 High
- gitea open source git serverWebhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)CVE-2026-58440Fix available6.8 Medium
- gitea open source git serverRepository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository ExfiltrationCVE-2026-57894Fix available8.5 High
- gitea open source git serverGitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state writeCVE-2026-58426Fix available9.6 Critical
- gitea open source git serverPermanent Fork PR Workflow Approval Gate BypassCVE-2026-58424Public exploitFix available8.9 High
- gitea open source git serverLFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositoriesCVE-2026-58423Fix available7.7 High
- gitea open source git serverImproper authorization on OAuth sign-in callback silently re-enables administrator-disabled accountsCVE-2026-58422Fix available9.8 Critical
- Show olderLoading…