# code.gitea.io/gitea (Go) vulnerabilities 122 known vulnerabilities (22 critical, 35 high, 40 medium, 8 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.26.4 (Jun 21, 2026): affected by 38 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 253 since v0.9.99 (Oct 17, 2016) - Registry: https://pkg.go.dev/code.gitea.io/gitea - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-59766: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-60004: v1.17.0 to v1.27.0-dev (through the newest release) - CVE-2026-24791: v1.22.3 to v1.26.1 (v1.26.2 is outside it) - CVE-2026-59765: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-59763: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58511: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58510: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58507: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58445: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58444: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58443: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58442: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58441: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58439: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58437: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58436: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58435: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58434: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58432: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58429: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58428: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58425: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58314: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-57897: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-57894: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-57886: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-56755: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-56750: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-56657: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-56654: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-56443: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-55987: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-55984: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-55982: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-54481: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-50105: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-42931: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-23603: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-34966: v0.9.99 to v1.27.0-dev (through the newest release) - CVE-2026-58426: v1.22.0 to v1.26.1 (v1.26.2 is outside it) - CVE-2026-58424: v0.9.99 to v1.26.2 (v1.26.3 is outside it) - CVE-2026-58423: v1.23.0 to v1.26.2 (v1.26.3 is outside it) - CVE-2026-58422: v0.9.99 to v1.26.3 (v1.26.4 is outside it) - CVE-2026-58421: v0.9.99 to v1.26.3 (v1.26.4 is outside it) - CVE-2026-58419: v0.9.99 to v1.26.3 (v1.26.4 is outside it) - CVE-2026-58418: v0.9.99 to v1.26.3 (v1.26.4 is outside it) - CVE-2026-28744: v0.9.99 to v1.26.1 (v1.26.2 is outside it) - CVE-2026-28740: v0.9.99 to v1.26.2 (v1.26.3 is outside it) - CVE-2026-28737: v1.25.0 to v1.26.0-rc0 (v1.26.0 is outside it) - CVE-2026-28705: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-28699: v0.9.99 to v1.26.1 (v1.26.2 is outside it) - CVE-2026-27783: v0.9.99 to v1.26.1 (v1.26.2 is outside it) - CVE-2026-27780: v0.9.99 to v1.26.0-rc0 (v1.26.0 is outside it) - CVE-2026-27779: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-27775: v0.9.99 to v1.26.2 (v1.26.3 is outside it) - CVE-2026-27771: v0.9.99 to v1.26.1 (v1.26.2 is outside it) - CVE-2026-27761: v0.9.99 to v1.26.2 (v1.26.3 is outside it) - CVE-2026-27660: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-27657: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-26307: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-26292: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-26247: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-26232: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-26231: v0.9.99 to v1.26.1 (v1.26.2 is outside it) - CVE-2026-25782: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-25779: v0.9.99 to v1.26.0-rc0 (v1.26.0 is outside it) - CVE-2026-25718: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-25714: v0.9.99 to v1.26.1 (v1.26.2 is outside it) - CVE-2026-25712: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-25038: v0.9.99 to v1.26.2 (v1.26.3 is outside it) - CVE-2026-24690: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-24451: v0.9.99 to v1.26.2 (v1.26.3 is outside it) - CVE-2026-22874: v0.9.99 to v1.26.2 (v1.26.3 is outside it) - CVE-2026-22555: v0.9.99 to v1.26.0-rc0 (v1.26.0 is outside it) - CVE-2026-22547: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-20909: v0.9.99 to v1.25.4 (v1.25.5 is outside it) - CVE-2026-20896: v0.9.99 to v1.26.2 (v1.26.3 is outside it) - CVE-2026-20779: v1.5.0 to v1.26.2 (v1.26.3 is outside it) - CVE-2026-20706: v0.9.99 to v1.26.1 (v1.26.2 is outside it) - CVE-2026-20912: v0.9.99 to v1.25.3 (v1.25.4 is outside it) - CVE-2026-20904: v0.9.99 to v1.25.3 (v1.25.4 is outside it) - CVE-2026-20897: v0.9.99 to v1.25.3 (v1.25.4 is outside it) - CVE-2026-20888: v0.9.99 to v1.25.3 (v1.25.4 is outside it) - CVE-2026-20883: v0.9.99 to v1.25.3 (v1.25.4 is outside it) - CVE-2026-20800: v0.9.99 to v1.25.3 (v1.25.4 is outside it) - CVE-2026-20750: v0.9.99 to v1.25.3 (v1.25.4 is outside it) - CVE-2026-20736: v0.9.99 to v1.25.3 (v1.25.4 is outside it) - CVE-2026-0798: v0.9.99 to v1.25.3 (v1.25.4 is outside it) - CVE-2025-69413: v0.9.99 to v1.25.1 (v1.25.2 is outside it) - CVE-2025-68946: v0.9.99 to v1.20.0 (v1.20.1 is outside it) - CVE-2025-68945: v0.9.99 to v1.21.1 (v1.21.2 is outside it) - CVE-2025-68944: v0.9.99 to v1.22.1 (v1.22.2 is outside it) - CVE-2025-68943: v0.9.99 to v1.21.7 (v1.21.8 is outside it) - CVE-2025-68942: v0.9.99 to v1.22.1 (v1.22.2 is outside it) - CVE-2025-68941: v0.9.99 to v1.22.2 (v1.22.3 is outside it) - CVE-2025-68940: v0.9.99 to v1.22.4 (v1.22.5 is outside it) - CVE-2025-68939: v0.9.99 to v1.23.0-dev (v1.23.0-rc0 is outside it) - CVE-2025-68938: v0.9.99 to v1.25.1 (v1.25.2 is outside it) - CVE-2024-6886: v0.9.99 to v1.22.0 (v1.22.1 is outside it) - CVE-2022-38795: v0.9.99 to v1.17.1 (v1.17.2 is outside it) - CVE-2023-3515: v0.9.99 to v1.19.3 (v1.19.4 is outside it) - CVE-2022-42968: v0.9.99 to v1.17.2 (v1.17.3 is outside it) - CVE-2022-38183: v0.9.99 to v1.16.8 (v1.16.9 is outside it) - CVE-2022-1928: v0.9.99 to v1.16.8 (v1.16.9 is outside it) - CVE-2022-30781: v0.9.99 to v1.16.6 (v1.16.7 is outside it) - CVE-2022-27313: v0.9.99 to v1.16.3 (v1.16.4 is outside it) - CVE-2022-1058: v0.9.99 to v1.16.4 (v1.16.5 is outside it) - CVE-2021-29134: v0.9.99 to v1.13.5 (v1.13.6 is outside it) - CVE-2022-0905: v0.9.99 to v1.16.3 (v1.16.4 is outside it) - CVE-2021-45331: v0.9.99 to v1.5.0-rc2 (v1.5.0 is outside it) - CVE-2021-45330: v0.9.99 to v1.6.0-rc2 (v1.6.0 is outside it) - CVE-2021-45327: v0.9.99 to v1.11.1 (v1.11.2 is outside it) - CVE-2021-28378: v0.9.99 to v1.13.3 (v1.13.4 is outside it) - CVE-2021-3382: v1.9.0 to v1.13.1 (v1.13.2 is outside it) - CVE-2020-14144: v1.1.0 to v1.12.5 (v1.12.6 is outside it) - CVE-2020-13246: v0.9.99 to v1.12.0-rc2 (v1.12.0 is outside it) - CVE-2019-1010261: v0.9.99 to v1.7.0 (v1.7.1 is outside it) - CVE-2019-1010314: v1.7.2 to v1.7.3 (v1.7.4 is outside it) - CVE-2019-11576: v0.9.99 to v1.8.0-rc3 (v1.8.0 is outside it) - CVE-2019-1000002: v0.9.99 to v1.6.2 (v1.6.3 is outside it) - CVE-2018-18926: v0.9.99 to v1.5.1 (v1.5.2 is outside it) - CVE-2018-15192: v0.9.99 to v1.16.0-dev (v1.16.0-rc1 is outside it) ## Advisories (122) ### [CVE-2026-59766](https://cve.now/CVE-2026-59766): Gitea private repository metadata disclosure after access revocation - Severity: Medium 4.3 - Published: Oct 14, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-60004](https://cve.now/CVE-2026-60004): Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. - Severity: Critical 9.8 · KEV - Published: Aug 26, 2026 - Affected: from 1.17.0. - No fix released. The latest release, v1.26.4, is still affected. ### [CVE-2026-24791](https://cve.now/CVE-2026-24791): Public-only tokens bypass private-resource restrictions on \`/api/v1/user\` self routes - Severity: High 8.1 - Published: Aug 13, 2026 - Affected: from 1.22.3, fixed in 1.26.2. - Fixed in v1.26.2 (released May 20, 2026, 85 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-59765](https://cve.now/CVE-2026-59765): SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata - Severity: High 7.5 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-59763](https://cve.now/CVE-2026-59763): Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads - Severity: Medium 4.3 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58511](https://cve.now/CVE-2026-58511): Webhook Authorization Header Returned in Plaintext via API - Severity: Low 2.7 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58510](https://cve.now/CVE-2026-58510): GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-\>private - Severity: Medium 4.3 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58507](https://cve.now/CVE-2026-58507): Private Repository Existence Disclosure via go-get Meta Endpoint - Severity: Medium 5.3 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58445](https://cve.now/CVE-2026-58445): Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API - Severity: Low 2.7 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58444](https://cve.now/CVE-2026-58444): Personal access token scope enforcement bypass on the repository home page (\`GET /{owner}/{repo}\`) discloses private repository contents - Severity: Medium 4.3 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58443](https://cve.now/CVE-2026-58443): Public-only repository tokens can update private PR head branches - Severity: Critical 9.1 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58442](https://cve.now/CVE-2026-58442): Repository migration SSRF via multi-answer DNS allow-list bypass - Severity: Medium 6.5 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58441](https://cve.now/CVE-2026-58441): SSRF in restore-repo via unsanitized pull\_request.yml Head.CloneURL - Severity: Medium 6.3 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58439](https://cve.now/CVE-2026-58439): Branch Protection Bypass via PR Retargeting Preserves Stale \`official\` Approval Flag - Severity: High 8.1 - Published: Aug 13, 2026 - Affected: all versions; fixed in 1.27.0. - No fix released. The latest release, v1.26.4, is still affected. ### [CVE-2026-58437](https://cve.now/CVE-2026-58437): Repository Visibility Manipulation via Git Push Options - Severity: High 7.1 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58436](https://cve.now/CVE-2026-58436): ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests - Severity: High 7.5 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58435](https://cve.now/CVE-2026-58435): Gitea LFS Deploy-Key Privilege Escalation - Severity: Medium 5.4 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58434](https://cve.now/CVE-2026-58434): Private Repository Metadata Remains Accessible After Access Revocation - Severity: High 7.5 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58432](https://cve.now/CVE-2026-58432): Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and… - Severity: Medium 5.9 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58429](https://cve.now/CVE-2026-58429): Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints - Severity: Medium 4.9 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58428](https://cve.now/CVE-2026-58428): Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) - Severity: Medium 6.5 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58425](https://cve.now/CVE-2026-58425): OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) - Severity: Medium 4.3 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58314](https://cve.now/CVE-2026-58314): Two SSRF findings in Gitea 1.26.2 - Severity: High 7.7 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-57897](https://cve.now/CVE-2026-57897): Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs - Severity: Medium 6.5 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-57894](https://cve.now/CVE-2026-57894): Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration - Severity: High 8.5 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-57886](https://cve.now/CVE-2026-57886): Cross-repository issue/comment attachment re-linking can expose private attachment content - Severity: Medium 5.9 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-56755](https://cve.now/CVE-2026-56755): Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload - Severity: Medium 6.2 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-56750](https://cve.now/CVE-2026-56750): Gitea Remember-Me Token Theft Not Invalidating Attacker Session - Severity: Critical 9.1 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-56657](https://cve.now/CVE-2026-56657): Gitea SSH Key Parser Denial of Service - Severity: Medium 6.2 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-56654](https://cve.now/CVE-2026-56654): Privilege Escalation via Access Token Scope Escalation in API - Severity: Critical 9.8 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-56443](https://cve.now/CVE-2026-56443): Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 - Severity: Critical 9.6 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-55987](https://cve.now/CVE-2026-55987): OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) - Severity: High 8.1 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-55984](https://cve.now/CVE-2026-55984): Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service - Severity: Low 2.7 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-55982](https://cve.now/CVE-2026-55982): OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes - Severity: Critical 9.1 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-54481](https://cve.now/CVE-2026-54481): Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) - Severity: High 7.5 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-50105](https://cve.now/CVE-2026-50105): RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) - Severity: Medium 4.3 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-42931](https://cve.now/CVE-2026-42931): Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint - Severity: Medium 6.5 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-23603](https://cve.now/CVE-2026-23603): Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim - Severity: Low 3.1 - Published: Aug 13, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-34966](https://cve.now/CVE-2026-34966): Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass - Severity: High 8.3 - Published: Aug 5, 2026 - Affected: fixed in 1.27.0. - No fix released. The advisory names 1.27.0 as the fix, which the registry doesn't have yet. The latest release, v1.26.4, is still affected. ### [CVE-2026-58426](https://cve.now/CVE-2026-58426): Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write - Severity: Critical 9.6 - Published: Jul 3, 2026 - Affected: from 1.22.0, fixed in 1.26.2. - Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-58424](https://cve.now/CVE-2026-58424): Permanent Fork PR Workflow Approval Gate Bypass - Severity: High 8.9 - Published: Jul 3, 2026 - Affected: fixed in 1.26.3. - Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-58423](https://cve.now/CVE-2026-58423): LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories - Severity: High 7.7 - Published: Jul 3, 2026 - Affected: from 1.23.0, fixed in 1.26.3. - Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-58422](https://cve.now/CVE-2026-58422): Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts - Severity: Critical 9.8 - Published: Jul 3, 2026 - Affected: fixed in 1.26.4. - Fixed in v1.26.4 (released Jun 21, 2026, 12 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-58421](https://cve.now/CVE-2026-58421): Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service - Severity: High 7.5 - Published: Jul 3, 2026 - Affected: fixed in 1.26.4. - Fixed in v1.26.4 (released Jun 21, 2026, 12 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-58419](https://cve.now/CVE-2026-58419): Notification API leaks private issue metadata after access revocation - Severity: High 7.5 - Published: Jul 3, 2026 - Affected: fixed in 1.26.4. - Fixed in v1.26.4 (released Jun 21, 2026, 12 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-58418](https://cve.now/CVE-2026-58418): SSRF via HTTP Redirect in Repository Migration - Severity: Medium 6.5 - Published: Jul 3, 2026 - Affected: fixed in 1.26.4. - Fixed in v1.26.4 (released Jun 21, 2026, 12 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-28744](https://cve.now/CVE-2026-28744): Gitea Git smart HTTP bypasses repository token scopes for bearer tokens - Severity: High 8.1 - Published: Jul 3, 2026 - Affected: fixed in 1.26.2. - Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-28740](https://cve.now/CVE-2026-28740): Gitea LFS object reuse bypasses Code-unit authorization - Severity: High 7.1 - Published: Jul 3, 2026 - Affected: fixed in 1.26.3. - Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-28737](https://cve.now/CVE-2026-28737): Gitea 3D file viewer allows stored XSS through glTF extensionsRequired - Severity: High 8.7 - Published: Jul 3, 2026 - Affected: from 1.25.0, fixed in 1.26.0. - Fixed in v1.26.0 (released Apr 18, 2026, 76 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-28705](https://cve.now/CVE-2026-28705): Gitea repository dumps write release assets using unsafe path names - Severity: Medium 5.3 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-28699](https://cve.now/CVE-2026-28699): Gitea Basic Auth bypasses OAuth2 access token scopes - Severity: High 8.1 - Published: Jul 3, 2026 - Affected: fixed in 1.26.2. - Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-27783](https://cve.now/CVE-2026-27783): Gitea issue-template APIs bypass repository unit authorization - Severity: Medium 4.3 - Published: Jul 3, 2026 - Affected: fixed in 1.26.2. - Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-27780](https://cve.now/CVE-2026-27780): Gitea pre-receive hook can miss branch-protection checks after scanner errors - Severity: Critical 9.8 - Published: Jul 3, 2026 - Affected: fixed in 1.26.0. - Fixed in v1.26.0 (released Apr 18, 2026, 76 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-27779](https://cve.now/CVE-2026-27779): Gitea forwarded-proto handling allows public URL spoofing - Severity: High 7.5 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-27775](https://cve.now/CVE-2026-27775): Gitea pre-receive hook permission cache allows full repository write access - Severity: High 8.8 - Published: Jul 3, 2026 - Affected: fixed in 1.26.3. - Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-27771](https://cve.now/CVE-2026-27771): Gitea Composer package source links use insufficient permission checks - Severity: High 8.2 - Published: Jul 3, 2026 - Affected: fixed in 1.26.2. - Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-27761](https://cve.now/CVE-2026-27761): Gitea repository feeds bypass API token scope enforcement - Severity: Medium 4.3 - Published: Jul 3, 2026 - Affected: fixed in 1.26.3. - Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-27660](https://cve.now/CVE-2026-27660): Gitea draft releases use insufficient permission checks - Severity: High 7.5 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-27657](https://cve.now/CVE-2026-27657): Gitea email settings allow changing another user's primary email address - Severity: High 7.5 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-26307](https://cve.now/CVE-2026-26307): Gitea git grep search lacks a timeout - Severity: High 7.5 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-26292](https://cve.now/CVE-2026-26292): Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions - Severity: Critical 9.8 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-26247](https://cve.now/CVE-2026-26247): Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange - Severity: Critical 9.1 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-26232](https://cve.now/CVE-2026-26232): Gitea OAuth2 authorization codes lack expiry and reuse enforcement - Severity: Critical 9.1 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-26231](https://cve.now/CVE-2026-26231): Gitea maintainer-edit permissions allow unauthorized commits to readable repositories - Severity: High 8.5 - Published: Jul 3, 2026 - Affected: fixed in 1.26.2. - Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-25782](https://cve.now/CVE-2026-25782): Gitea tracked-time deletion can target entries from another issue - Severity: Medium 5.3 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-25779](https://cve.now/CVE-2026-25779): Gitea redirect handling permits open redirects through backslash paths - Severity: Medium 6.1 - Published: Jul 3, 2026 - Affected: fixed in 1.26.0. - Fixed in v1.26.0 (released Apr 18, 2026, 76 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-25718](https://cve.now/CVE-2026-25718): Gitea template repository generation mishandles symlinked paths - Severity: Critical 9.1 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-25714](https://cve.now/CVE-2026-25714): Gitea user organization API bypasses public-only token filtering - Severity: Medium 4.3 - Published: Jul 3, 2026 - Affected: fixed in 1.26.2. - Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-25712](https://cve.now/CVE-2026-25712): Gitea organization permission APIs expose private visibility information - Severity: High 7.5 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-25038](https://cve.now/CVE-2026-25038): Gitea private organization labels are visible to unauthorized users - Severity: High 7.5 - Published: Jul 3, 2026 - Affected: fixed in 1.26.3. - Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-24690](https://cve.now/CVE-2026-24690): Gitea pull-request branch updates use insufficient permission checks - Severity: High 7.5 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-24451](https://cve.now/CVE-2026-24451): Gitea fork synchronization can expose private parent repository data - Severity: High 7.5 - Published: Jul 3, 2026 - Affected: fixed in 1.26.3. - Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-22874](https://cve.now/CVE-2026-22874): Gitea webhook and migration allow-list filtering permits SSRF - Severity: Critical 9.6 - Published: Jul 3, 2026 - Affected: fixed in 1.26.3. - Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-22555](https://cve.now/CVE-2026-22555): Gitea organization forks can expose organization secrets without create permission - Severity: High 8.1 - Published: Jul 3, 2026 - Affected: fixed in 1.26.0. - Fixed in v1.26.0 (released Apr 18, 2026, 76 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-22547](https://cve.now/CVE-2026-22547): Gitea repository creation accepts invalid field values - Severity: Critical 9.1 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-20909](https://cve.now/CVE-2026-20909): Gitea tracked-time list endpoint has insufficient permission checks - Severity: Medium 5.3 - Published: Jul 3, 2026 - Affected: fixed in 1.25.5. - Fixed in v1.25.5 (released Mar 13, 2026, 112 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-20896](https://cve.now/CVE-2026-20896): Gitea Docker image trusts spoofable reverse-proxy headers by default - Severity: Critical 9.8 - Published: Jul 3, 2026 - Affected: fixed in 1.26.3. - Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-20779](https://cve.now/CVE-2026-20779): Gitea TOTP single-use enforcement defect allows OTP replay - Severity: High 7.1 - Published: Jul 3, 2026 - Affected: from 1.5.0, fixed in 1.26.3. - Fixed in v1.26.3 (released Jun 20, 2026, 13 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-20706](https://cve.now/CVE-2026-20706): Gitea repository archive downloads bypass token scope checks - Severity: Critical 9.1 - Published: Jul 3, 2026 - Affected: fixed in 1.26.2. - Fixed in v1.26.2 (released May 20, 2026, 44 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-20912](https://cve.now/CVE-2026-20912): Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure - Severity: Critical 9.1 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-20904](https://cve.now/CVE-2026-20904): Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes - Severity: Medium 6.5 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-20897](https://cve.now/CVE-2026-20897): Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) - Severity: Critical 9.1 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-20888](https://cve.now/CVE-2026-20888): Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass) - Severity: Medium 4.3 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-20883](https://cve.now/CVE-2026-20883): Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure - Severity: Medium 6.5 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-20800](https://cve.now/CVE-2026-20800): Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation - Severity: Medium 6.5 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-20750](https://cve.now/CVE-2026-20750): Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR) - Severity: Critical 9.1 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-20736](https://cve.now/CVE-2026-20736): Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check - Severity: High 7.5 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2026-0798](https://cve.now/CVE-2026-0798): Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation - Severity: Low 3.5 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - Fixed in v1.25.4 (released Jan 22, 2026, the day of disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2025-69413](https://cve.now/CVE-2025-69413): In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. - Severity: Medium 5.3 - Published: Jan 1, 2026 - Affected: fixed in 1.25.2. - Fixed in v1.25.2 (released Nov 22, 2025, 40 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2025-68946](https://cve.now/CVE-2025-68946): In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS. - Severity: Medium 5.4 - Published: Dec 26, 2025 - Affected: fixed in 1.20.1. - Fixed in v1.20.1 (released Jul 22, 2023, 888 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2025-68945](https://cve.now/CVE-2025-68945): In Gitea before 1.21.2, an anonymous user can visit a private user's project. - Severity: Medium 5.8 - Published: Dec 26, 2025 - Affected: fixed in 1.21.2. - Fixed in v1.21.2 (released Dec 12, 2023, 745 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2025-68944](https://cve.now/CVE-2025-68944): Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries. - Severity: Medium 5.0 - Published: Dec 26, 2025 - Affected: fixed in 1.22.2. - Fixed in v1.22.2 (released Sep 5, 2024, 477 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2025-68943](https://cve.now/CVE-2025-68943): Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order. - Severity: Medium 5.3 - Published: Dec 26, 2025 - Affected: fixed in 1.21.8. - Fixed in v1.21.8 (released Mar 13, 2024, 653 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2025-68942](https://cve.now/CVE-2025-68942): Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text. - Severity: Medium 5.4 - Published: Dec 26, 2025 - Affected: fixed in 1.22.2. - Fixed in v1.22.2 (released Sep 5, 2024, 477 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2025-68941](https://cve.now/CVE-2025-68941): Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources. - Severity: Medium 4.9 - Published: Dec 26, 2025 - Affected: fixed in 1.22.3. - Fixed in v1.22.3 (released Oct 9, 2024, 443 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2025-68940](https://cve.now/CVE-2025-68940): In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request. - Severity: Low 3.1 - Published: Dec 26, 2025 - Affected: fixed in 1.22.5. - Fixed in v1.22.5 (released Dec 11, 2024, 380 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2025-68939](https://cve.now/CVE-2025-68939): Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API. - Severity: High 8.2 - Published: Dec 26, 2025 - Affected: fixed in 1.23.0-rc0. - Fixed in v1.23.0-rc0 (released Dec 17, 2024, 374 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2025-68938](https://cve.now/CVE-2025-68938): Gitea before 1.25.2 mishandles authorization for deletion of releases. - Severity: Medium 4.3 - Published: Dec 26, 2025 - Affected: fixed in 1.25.2. - Fixed in v1.25.2 (released Nov 22, 2025, 34 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2024-6886](https://cve.now/CVE-2024-6886): Inproper Sanitation of field leading to stored XSS - Severity: Critical 10.0 - Published: Aug 6, 2024 - Affected: fixed in 1.22.1. - Fixed in v1.22.1 (released Jul 4, 2024, 33 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2022-38795](https://cve.now/CVE-2022-38795): In Gitea through 1.17.1, repo cloning can occur in the migration function. - Severity: Unrated - Published: Aug 7, 2023 - Affected: fixed in 1.17.2. - Fixed in v1.17.2 (released Sep 6, 2022, 335 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2023-3515](https://cve.now/CVE-2023-3515): Open Redirect in go-gitea/gitea - Severity: Low 3.0 - Published: Jul 5, 2023 - Affected: fixed in 1.19.4. - Fixed in v1.19.4 (released Jul 4, 2023, 1 day before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2022-42968](https://cve.now/CVE-2022-42968): Gitea before 1.17.3 does not sanitize and escape refs in the git backend. - Severity: Critical 9.8 - Published: Oct 16, 2022 - Affected: fixed in 1.17.3. - Fixed in v1.17.3 (released Oct 15, 2022, 1 day before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2022-38183](https://cve.now/CVE-2022-38183): In Gitea before 1.16.9, it was possible for users to add existing issues to projects. - Severity: Unrated - Published: Aug 12, 2022 - Affected: fixed in 1.16.9. - Fixed in v1.16.9 (released Jun 21, 2022, 52 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2022-1928](https://cve.now/CVE-2022-1928): Cross-site Scripting (XSS) - Stored in go-gitea/gitea - Severity: Medium 4.4 - Published: May 29, 2022 - Affected: fixed in 1.16.9. - Fixed in v1.16.9 (released Jun 21, 2022, 23 days after disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2022-30781](https://cve.now/CVE-2022-30781): Gitea before 1.16.7 does not escape git fetch remote. - Severity: Unrated - Published: May 16, 2022 - Affected: fixed in 1.16.7. - Fixed in v1.16.7 (released May 2, 2022, 14 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2022-27313](https://cve.now/CVE-2022-27313): An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the… - Severity: Unrated - Published: May 3, 2022 - Affected: fixed in 1.16.4. - Fixed in v1.16.4 (released Mar 14, 2022, 50 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2022-1058](https://cve.now/CVE-2022-1058): Open Redirect on login in go-gitea/gitea - Severity: High 7.2 - Published: Mar 24, 2022 - Affected: fixed in 1.16.5. - Fixed in v1.16.5 (released Mar 24, 2022, the day of disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2021-29134](https://cve.now/CVE-2021-29134): The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL. - Severity: Unrated - Published: Mar 15, 2022 - Affected: fixed in 1.13.6. - Fixed in v1.13.6 (released Mar 23, 2021, 357 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2022-0905](https://cve.now/CVE-2022-0905): Missing Authorization in go-gitea/gitea - Severity: Medium 6.5 - Published: Mar 10, 2022 - Affected: fixed in 1.16.4. - Fixed in v1.16.4 (released Mar 14, 2022, 4 days after disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2021-45331](https://cve.now/CVE-2021-45331): An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. - Severity: Unrated - Published: Feb 9, 2022 - Affected: fixed in 1.5.0. - Fixed in v1.5.0 (released Aug 10, 2018, 1279 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2021-45330](https://cve.now/CVE-2021-45330): An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and… - Severity: Unrated - Published: Feb 9, 2022 - Affected: fixed in 1.6.0. - Fixed in v1.6.0 (released Nov 23, 2018, 1174 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2021-45327](https://cve.now/CVE-2021-45327): Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. - Severity: Unrated - Published: Feb 8, 2022 - Affected: fixed in 1.11.2. - Fixed in v1.11.2 (released Mar 6, 2020, 704 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2021-28378](https://cve.now/CVE-2021-28378): Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations. - Severity: Low 3.7 - Published: Mar 15, 2021 - Affected: fixed in 1.13.4. - Fixed in v1.13.4 (released Mar 7, 2021, 8 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2021-3382](https://cve.now/CVE-2021-3382): Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors… - Severity: Unrated - Published: Feb 5, 2021 - Affected: from 1.9.0, fixed in 1.13.2. - Fixed in v1.13.2 (released Feb 1, 2021, 4 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2020-14144](https://cve.now/CVE-2020-14144): The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the… - Severity: Unrated - Published: Oct 16, 2020 - Affected: from 1.1.0, fixed in 1.12.6. - Fixed in v1.12.6 (released Nov 16, 2020, 31 days after disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2020-13246](https://cve.now/CVE-2020-13246): An issue was discovered in Gitea through 1.11.5. - Severity: Unrated - Published: May 20, 2020 - Affected: fixed in 1.12.0. - Fixed in v1.12.0 (released Jun 18, 2020, 29 days after disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2019-1010261](https://cve.now/CVE-2019-1010261): Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). - Severity: Unrated - Published: Jul 18, 2019 - Affected: fixed in 1.7.1. - Fixed in v1.7.1 (released Jan 31, 2019, 168 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2019-1010314](https://cve.now/CVE-2019-1010314): Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). - Severity: Unrated - Published: Jul 11, 2019 - Affected: from 1.7.2, fixed in 1.7.4. - Fixed in v1.7.4 (released Mar 13, 2019, 120 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2019-11576](https://cve.now/CVE-2019-11576): Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. - Severity: Unrated - Published: Apr 28, 2019 - Affected: fixed in 1.8.0. - Fixed in v1.8.0 (released Apr 20, 2019, 8 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2019-1000002](https://cve.now/CVE-2019-1000002): Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in… - Severity: Unrated - Published: Feb 4, 2019 - Affected: fixed in 1.6.3. - Fixed in v1.6.3 (released Jan 4, 2019, 31 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2018-18926](https://cve.now/CVE-2018-18926): Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. - Severity: Unrated - Published: Nov 4, 2018 - Affected: fixed in 1.5.2. - Fixed in v1.5.2 (released Oct 9, 2018, 26 days before disclosure). - The latest release, v1.26.4, is not affected. ### [CVE-2018-15192](https://cve.now/CVE-2018-15192): An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. - Severity: Unrated - Published: Aug 8, 2018 - Affected: fixed in 1.16.0-rc1. - Fixed in v1.16.0-rc1 (released Jan 19, 2022, 1260 days after disclosure). - The latest release, v1.26.4, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/code.gitea.io/gitea Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.