Skip to main content
cve.nowby Sazabi
← Go
GoPackage

code.gitea.io/gitea

122 known vulnerabilities (22 critical, 35 high, 40 medium, 8 low), with the versions each affects and the releases that fix them.

Latest release
v1.26.4 (Jun 21, 2026): affected by 38 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
122 · 22 critical, 35 high, 40 medium, 8 low
Releases
253 since v0.9.99 (Oct 17, 2016)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-59766
    Affects v0.9.99 to v1.27.0-dev (through the newest release)
  • CVE-2026-60004
    Affects v1.17.0 to v1.27.0-dev (through the newest release)
  • CVE-2026-24791
    Affects v1.22.3 to v1.26.1 (v1.26.2 is outside it)
  • CVE-2026-59765
    Affects v0.9.99 to v1.27.0-dev (through the newest release)
  • CVE-2026-59763
    Affects v0.9.99 to v1.27.0-dev (through the newest release)
  • CVE-2026-58511
    Affects v0.9.99 to v1.27.0-dev (through the newest release)
  • CVE-2026-58510
    Affects v0.9.99 to v1.27.0-dev (through the newest release)
  • CVE-2026-58507
    Affects v0.9.99 to v1.27.0-dev (through the newest release)
  • CVE-2026-58445
    Affects v0.9.99 to v1.27.0-dev (through the newest release)
  • CVE-2026-58444
    Affects v0.9.99 to v1.27.0-dev (through the newest release)
  • CVE-2026-58443
    Affects v0.9.99 to v1.27.0-dev (through the newest release)
  • CVE-2026-58442
    Affects v0.9.99 to v1.27.0-dev (through the newest release)
Show all 122 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 122

  • CVE-2026-59766Medium 4.3

    Gitea private repository metadata disclosure after access revocation

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-60004Critical 9.8 · KEV

    Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

    Affected: from 1.17.0.

    No fix released. The latest release, v1.26.4, is still affected.

  • Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

    Affected: from 1.22.3, fixed in 1.26.2.

    Fixed in v1.26.2 (released May 20, 2026, 85 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-59763Medium 4.3

    Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • Webhook Authorization Header Returned in Plaintext via API

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-58510Medium 4.3

    GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-58507Medium 5.3

    Private Repository Existence Disclosure via go-get Meta Endpoint

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-58444Medium 4.3

    Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-58443Critical 9.1

    Public-only repository tokens can update private PR head branches

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-58442Medium 6.5

    Repository migration SSRF via multi-answer DNS allow-list bypass

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-58441Medium 6.3

    SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

    Affected: all versions; fixed in 1.27.0.

    No fix released. The latest release, v1.26.4, is still affected.

  • Repository Visibility Manipulation via Git Push Options

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

Show all 122 advisoriesShow fewer advisories

  • ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-58435Medium 5.4

    Gitea LFS Deploy-Key Privilege Escalation

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • Private Repository Metadata Remains Accessible After Access Revocation

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-58432Medium 5.9

    Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and…

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-58429Medium 4.9

    Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-58428Medium 6.5

    Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-58425Medium 4.3

    OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • Two SSRF findings in Gitea 1.26.2

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-57897Medium 6.5

    Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-57886Medium 5.9

    Cross-repository issue/comment attachment re-linking can expose private attachment content

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-56755Medium 6.2

    Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-56750Critical 9.1

    Gitea Remember-Me Token Theft Not Invalidating Attacker Session

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-56657Medium 6.2

    Gitea SSH Key Parser Denial of Service

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-56654Critical 9.8

    Privilege Escalation via Access Token Scope Escalation in API

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-56443Critical 9.6

    Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-55982Critical 9.1

    OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-50105Medium 4.3

    RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-42931Medium 6.5

    Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

    Affected: fixed in 1.27.0.

    No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected.

  • CVE-2026-58426Critical 9.6

    Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

    Affected: from 1.22.0, fixed in 1.26.2.

    Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Permanent Fork PR Workflow Approval Gate Bypass

    Affected: fixed in 1.26.3.

    Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

    Affected: from 1.23.0, fixed in 1.26.3.

    Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-58422Critical 9.8

    Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

    Affected: fixed in 1.26.4.

    Fixed in v1.26.4 (released Jun 21, 2026, 12 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

    Affected: fixed in 1.26.4.

    Fixed in v1.26.4 (released Jun 21, 2026, 12 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Notification API leaks private issue metadata after access revocation

    Affected: fixed in 1.26.4.

    Fixed in v1.26.4 (released Jun 21, 2026, 12 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-58418Medium 6.5

    SSRF via HTTP Redirect in Repository Migration

    Affected: fixed in 1.26.4.

    Fixed in v1.26.4 (released Jun 21, 2026, 12 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea Git smart HTTP bypasses repository token scopes for bearer tokens

    Affected: fixed in 1.26.2.

    Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea LFS object reuse bypasses Code-unit authorization

    Affected: fixed in 1.26.3.

    Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea 3D file viewer allows stored XSS through glTF extensionsRequired

    Affected: from 1.25.0, fixed in 1.26.0.

    Fixed in v1.26.0 (released Apr 18, 2026, 76 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-28705Medium 5.3

    Gitea repository dumps write release assets using unsafe path names

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea Basic Auth bypasses OAuth2 access token scopes

    Affected: fixed in 1.26.2.

    Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-27783Medium 4.3

    Gitea issue-template APIs bypass repository unit authorization

    Affected: fixed in 1.26.2.

    Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-27780Critical 9.8

    Gitea pre-receive hook can miss branch-protection checks after scanner errors

    Affected: fixed in 1.26.0.

    Fixed in v1.26.0 (released Apr 18, 2026, 76 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea forwarded-proto handling allows public URL spoofing

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea pre-receive hook permission cache allows full repository write access

    Affected: fixed in 1.26.3.

    Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea Composer package source links use insufficient permission checks

    Affected: fixed in 1.26.2.

    Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-27761Medium 4.3

    Gitea repository feeds bypass API token scope enforcement

    Affected: fixed in 1.26.3.

    Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea draft releases use insufficient permission checks

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea email settings allow changing another user's primary email address

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea git grep search lacks a timeout

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-26292Critical 9.8

    Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-26247Critical 9.1

    Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-26232Critical 9.1

    Gitea OAuth2 authorization codes lack expiry and reuse enforcement

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea maintainer-edit permissions allow unauthorized commits to readable repositories

    Affected: fixed in 1.26.2.

    Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-25782Medium 5.3

    Gitea tracked-time deletion can target entries from another issue

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-25779Medium 6.1

    Gitea redirect handling permits open redirects through backslash paths

    Affected: fixed in 1.26.0.

    Fixed in v1.26.0 (released Apr 18, 2026, 76 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-25718Critical 9.1

    Gitea template repository generation mishandles symlinked paths

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-25714Medium 4.3

    Gitea user organization API bypasses public-only token filtering

    Affected: fixed in 1.26.2.

    Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea organization permission APIs expose private visibility information

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea private organization labels are visible to unauthorized users

    Affected: fixed in 1.26.3.

    Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea pull-request branch updates use insufficient permission checks

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea fork synchronization can expose private parent repository data

    Affected: fixed in 1.26.3.

    Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-22874Critical 9.6

    Gitea webhook and migration allow-list filtering permits SSRF

    Affected: fixed in 1.26.3.

    Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea organization forks can expose organization secrets without create permission

    Affected: fixed in 1.26.0.

    Fixed in v1.26.0 (released Apr 18, 2026, 76 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-22547Critical 9.1

    Gitea repository creation accepts invalid field values

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-20909Medium 5.3

    Gitea tracked-time list endpoint has insufficient permission checks

    Affected: fixed in 1.25.5.

    Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-20896Critical 9.8

    Gitea Docker image trusts spoofable reverse-proxy headers by default

    Affected: fixed in 1.26.3.

    Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea TOTP single-use enforcement defect allows OTP replay

    Affected: from 1.5.0, fixed in 1.26.3.

    Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-20706Critical 9.1

    Gitea repository archive downloads bypass token scope checks

    Affected: fixed in 1.26.2.

    Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-20912Critical 9.1

    Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure

    Affected: fixed in 1.25.4.

    Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-20904Medium 6.5

    Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes

    Affected: fixed in 1.25.4.

    Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-20897Critical 9.1

    Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)

    Affected: fixed in 1.25.4.

    Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-20888Medium 4.3

    Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)

    Affected: fixed in 1.25.4.

    Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-20883Medium 6.5

    Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure

    Affected: fixed in 1.25.4.

    Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-20800Medium 6.5

    Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation

    Affected: fixed in 1.25.4.

    Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2026-20750Critical 9.1

    Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)

    Affected: fixed in 1.25.4.

    Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check

    Affected: fixed in 1.25.4.

    Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation

    Affected: fixed in 1.25.4.

    Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2025-69413Medium 5.3

    In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

    Affected: fixed in 1.25.2.

    Fixed in v1.25.2 (released Nov 22, 2025, 40 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2025-68946Medium 5.4

    In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

    Affected: fixed in 1.20.1.

    Fixed in v1.20.1 (released Jul 22, 2023, 888 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2025-68945Medium 5.8

    In Gitea before 1.21.2, an anonymous user can visit a private user's project.

    Affected: fixed in 1.21.2.

    Fixed in v1.21.2 (released Dec 12, 2023, 745 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2025-68944Medium 5.0

    Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.

    Affected: fixed in 1.22.2.

    Fixed in v1.22.2 (released Sep 5, 2024, 477 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2025-68943Medium 5.3

    Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.

    Affected: fixed in 1.21.8.

    Fixed in v1.21.8 (released Mar 13, 2024, 653 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2025-68942Medium 5.4

    Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.

    Affected: fixed in 1.22.2.

    Fixed in v1.22.2 (released Sep 5, 2024, 477 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2025-68941Medium 4.9

    Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.

    Affected: fixed in 1.22.3.

    Fixed in v1.22.3 (released Oct 9, 2024, 443 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.

    Affected: fixed in 1.22.5.

    Fixed in v1.22.5 (released Dec 11, 2024, 380 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

    Affected: fixed in 1.23.0-rc0.

    Fixed in v1.23.0-rc0 (released Dec 17, 2024, 374 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2025-68938Medium 4.3

    Gitea before 1.25.2 mishandles authorization for deletion of releases.

    Affected: fixed in 1.25.2.

    Fixed in v1.25.2 (released Nov 22, 2025, 34 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2024-6886Critical 10.0

    Inproper Sanitation of field leading to stored XSS

    Affected: fixed in 1.22.1.

    Fixed in v1.22.1 (released Jul 4, 2024, 33 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • In Gitea through 1.17.1, repo cloning can occur in the migration function.

    Affected: fixed in 1.17.2.

    Fixed in v1.17.2 (released Sep 6, 2022, 335 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Open Redirect in go-gitea/gitea

    Affected: fixed in 1.19.4.

    Fixed in v1.19.4 (released Jul 4, 2023, 1 day before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2022-42968Critical 9.8

    Gitea before 1.17.3 does not sanitize and escape refs in the git backend.

    Affected: fixed in 1.17.3.

    Fixed in v1.17.3 (released Oct 15, 2022, 1 day before disclosure).

    The latest release, v1.26.4, is not affected.

  • In Gitea before 1.16.9, it was possible for users to add existing issues to projects.

    Affected: fixed in 1.16.9.

    Fixed in v1.16.9 (released Jun 21, 2022, 52 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2022-1928Medium 4.4

    Cross-site Scripting (XSS) - Stored in go-gitea/gitea

    Affected: fixed in 1.16.9.

    Fixed in v1.16.9 (released Jun 21, 2022, 23 days after disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea before 1.16.7 does not escape git fetch remote.

    Affected: fixed in 1.16.7.

    Fixed in v1.16.7 (released May 2, 2022, 14 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the…

    Affected: fixed in 1.16.4.

    Fixed in v1.16.4 (released Mar 14, 2022, 50 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Open Redirect on login in go-gitea/gitea

    Affected: fixed in 1.16.5.

    Fixed in v1.16.5 (released Mar 24, 2022, the day of disclosure).

    The latest release, v1.26.4, is not affected.

  • The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.

    Affected: fixed in 1.13.6.

    Fixed in v1.13.6 (released Mar 23, 2021, 357 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • CVE-2022-0905Medium 6.5

    Missing Authorization in go-gitea/gitea

    Affected: fixed in 1.16.4.

    Fixed in v1.16.4 (released Mar 14, 2022, 4 days after disclosure).

    The latest release, v1.26.4, is not affected.

  • An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges.

    Affected: fixed in 1.5.0.

    Fixed in v1.5.0 (released Aug 10, 2018, 1279 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and…

    Affected: fixed in 1.6.0.

    Fixed in v1.6.0 (released Nov 23, 2018, 1174 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API.

    Affected: fixed in 1.11.2.

    Fixed in v1.11.2 (released Mar 6, 2020, 704 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.

    Affected: fixed in 1.13.4.

    Fixed in v1.13.4 (released Mar 7, 2021, 8 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors…

    Affected: from 1.9.0, fixed in 1.13.2.

    Fixed in v1.13.2 (released Feb 1, 2021, 4 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the…

    Affected: from 1.1.0, fixed in 1.12.6.

    Fixed in v1.12.6 (released Nov 16, 2020, 31 days after disclosure).

    The latest release, v1.26.4, is not affected.

  • An issue was discovered in Gitea through 1.11.5.

    Affected: fixed in 1.12.0.

    Fixed in v1.12.0 (released Jun 18, 2020, 29 days after disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS).

    Affected: fixed in 1.7.1.

    Fixed in v1.7.1 (released Jan 31, 2019, 168 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS).

    Affected: from 1.7.2, fixed in 1.7.4.

    Fixed in v1.7.4 (released Mar 13, 2019, 120 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment.

    Affected: fixed in 1.8.0.

    Fixed in v1.8.0 (released Apr 20, 2019, 8 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in…

    Affected: fixed in 1.6.3.

    Fixed in v1.6.3 (released Jan 4, 2019, 31 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs.

    Affected: fixed in 1.5.2.

    Fixed in v1.5.2 (released Oct 9, 2018, 26 days before disclosure).

    The latest release, v1.26.4, is not affected.

  • An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.

    Affected: fixed in 1.16.0-rc1.

    Fixed in v1.16.0-rc1 (released Jan 19, 2022, 1260 days after disclosure).

    The latest release, v1.26.4, is not affected.