Skip to main content
cve.nowby Sazabi
← Go
GoPackage

gitea.dev

45 known vulnerabilities (6 critical, 14 high, 21 medium, 4 low), with the versions each affects and the releases that fix them.

Latest release
v1.27.3 (Aug 29, 2026): no advisory affects it
Newest unaffected release
v1.27.3 (Aug 29, 2026), the latest release
Advisories
45 · 6 critical, 14 high, 21 medium, 4 low
Releases
69 since v0.9.99 (Oct 17, 2016)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 45 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 45

  • CVE-2026-59766Medium 4.3

    Gitea private repository metadata disclosure after access revocation

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 93 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-60004Critical 9.8 · KEV

    Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

    Affected: from 1.17.0, fixed in 1.27.1; fixed in 1.27.1.

    Fixed in v1.27.1 (released Jul 27, 2026, 30 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-59763Medium 4.3

    Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Webhook Authorization Header Returned in Plaintext via API

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58510Medium 4.3

    GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58507Medium 5.3

    Private Repository Existence Disclosure via go-get Meta Endpoint

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58444Medium 4.3

    Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58443Critical 9.1

    Public-only repository tokens can update private PR head branches

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58442Medium 6.5

    Repository migration SSRF via multi-answer DNS allow-list bypass

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58441Medium 6.3

    SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58440Medium 6.8

    Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content…

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Repository Visibility Manipulation via Git Push Options

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

Show all 45 advisoriesShow fewer advisories

  • ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58435Medium 5.4

    Gitea LFS Deploy-Key Privilege Escalation

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Private Repository Metadata Remains Accessible After Access Revocation

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58432Medium 5.9

    Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and…

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58431Medium 4.3

    Public-only API token restriction is not enforced on team API routes

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58429Medium 4.9

    Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58428Medium 6.5

    Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58425Medium 4.3

    OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-58420Medium 4.4

    Local File Inclusion via file:// URI in Migration Restore

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • REST API exposes organization membership of private organizations to public

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Two SSRF findings in Gitea 1.26.2

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-57897Medium 6.5

    Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-57886Medium 5.9

    Cross-repository issue/comment attachment re-linking can expose private attachment content

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-56755Medium 6.2

    Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-56750Critical 9.1

    Gitea Remember-Me Token Theft Not Invalidating Attacker Session

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-56657Medium 6.2

    Gitea SSH Key Parser Denial of Service

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-56654Critical 9.8

    Privilege Escalation via Access Token Scope Escalation in API

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-56443Critical 9.6

    Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-55982Critical 9.1

    OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-50105Medium 4.3

    RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • CVE-2026-42931Medium 6.5

    Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

    Affected: fixed in 1.27.0.

    Fixed in v1.27.0 (released Jul 13, 2026, 23 days before disclosure).

    The latest release, v1.27.3, is not affected.

  • Gitea LFS object reuse bypasses Code-unit authorization

    Affected: fixed in 1.26.3.

    Fixed in v1.27.0 (released Jul 13, 2026, 10 days after disclosure, the advisory names 1.26.3, which was never published).

    The latest release, v1.27.3, is not affected.