# gitea.dev (Go) vulnerabilities

45 known vulnerabilities (6 critical, 14 high, 21 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: v1.27.3 (Aug 29, 2026): no advisory affects it
- Newest unaffected release: v1.27.3 (Aug 29, 2026), the latest release
- Releases: 69 since v0.9.99 (Oct 17, 2016)
- Registry: https://pkg.go.dev/gitea.dev
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-59766: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-60004: v0.9.99 to v1.27.0 (v1.27.1 is outside it)
- CVE-2026-59765: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-59763: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58511: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58510: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58507: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58445: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58444: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58443: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58442: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58441: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58440: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58438: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58437: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58436: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58435: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58434: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58432: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58431: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58429: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58428: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58427: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58425: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58420: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58417: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58416: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-58314: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-57897: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-57894: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-57886: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-56755: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-56750: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-56657: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-56654: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-56443: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-55987: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-55984: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-55982: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-54481: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-50105: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-42931: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-23603: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-34966: v0.9.99 to v1.27.0-rc0 (v1.27.0 is outside it)
- CVE-2026-28740: v0.9.99 to v1.9.0-dev (v1.27.0-rc0 is outside it)

## Advisories (45)

### [CVE-2026-59766](https://cve.now/CVE-2026-59766): Gitea private repository metadata disclosure after access revocation

- Severity: Medium 4.3
- Published: Oct 14, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 93 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-60004](https://cve.now/CVE-2026-60004): Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

- Severity: Critical 9.8 · KEV
- Published: Aug 26, 2026
- Affected: from 1.17.0, fixed in 1.27.1; fixed in 1.27.1.
- Fixed in v1.27.1 (released Jul 27, 2026, 30 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-59765](https://cve.now/CVE-2026-59765): SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

- Severity: High 7.5
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-59763](https://cve.now/CVE-2026-59763): Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

- Severity: Medium 4.3
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58511](https://cve.now/CVE-2026-58511): Webhook Authorization Header Returned in Plaintext via API

- Severity: Low 2.7
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58510](https://cve.now/CVE-2026-58510): GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-\>private

- Severity: Medium 4.3
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58507](https://cve.now/CVE-2026-58507): Private Repository Existence Disclosure via go-get Meta Endpoint

- Severity: Medium 5.3
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58445](https://cve.now/CVE-2026-58445): Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

- Severity: Low 2.7
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58444](https://cve.now/CVE-2026-58444): Personal access token scope enforcement bypass on the repository home page (\`GET /{owner}/{repo}\`) discloses private repository contents

- Severity: Medium 4.3
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58443](https://cve.now/CVE-2026-58443): Public-only repository tokens can update private PR head branches

- Severity: Critical 9.1
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58442](https://cve.now/CVE-2026-58442): Repository migration SSRF via multi-answer DNS allow-list bypass

- Severity: Medium 6.5
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58441](https://cve.now/CVE-2026-58441): SSRF in restore-repo via unsanitized pull\_request.yml Head.CloneURL

- Severity: Medium 6.3
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58440](https://cve.now/CVE-2026-58440): Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content…

- Severity: Medium 6.8
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58438](https://cve.now/CVE-2026-58438): Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

- Severity: High 7.5
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58437](https://cve.now/CVE-2026-58437): Repository Visibility Manipulation via Git Push Options

- Severity: High 7.1
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58436](https://cve.now/CVE-2026-58436): ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

- Severity: High 7.5
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58435](https://cve.now/CVE-2026-58435): Gitea LFS Deploy-Key Privilege Escalation

- Severity: Medium 5.4
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58434](https://cve.now/CVE-2026-58434): Private Repository Metadata Remains Accessible After Access Revocation

- Severity: High 7.5
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58432](https://cve.now/CVE-2026-58432): Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and…

- Severity: Medium 5.9
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58431](https://cve.now/CVE-2026-58431): Public-only API token restriction is not enforced on team API routes

- Severity: Medium 4.3
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58429](https://cve.now/CVE-2026-58429): Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

- Severity: Medium 4.9
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58428](https://cve.now/CVE-2026-58428): Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

- Severity: Medium 6.5
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58427](https://cve.now/CVE-2026-58427): Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

- Severity: High 7.5
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58425](https://cve.now/CVE-2026-58425): OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

- Severity: Medium 4.3
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58420](https://cve.now/CVE-2026-58420): Local File Inclusion via file:// URI in Migration Restore

- Severity: Medium 4.4
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58417](https://cve.now/CVE-2026-58417): REST API exposes organization membership of private organizations to public

- Severity: High 7.5
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58416](https://cve.now/CVE-2026-58416): Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

- Severity: High 7.1
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-58314](https://cve.now/CVE-2026-58314): Two SSRF findings in Gitea 1.26.2

- Severity: High 7.7
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-57897](https://cve.now/CVE-2026-57897): Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

- Severity: Medium 6.5
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-57894](https://cve.now/CVE-2026-57894): Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

- Severity: High 8.5
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-57886](https://cve.now/CVE-2026-57886): Cross-repository issue/comment attachment re-linking can expose private attachment content

- Severity: Medium 5.9
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-56755](https://cve.now/CVE-2026-56755): Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

- Severity: Medium 6.2
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-56750](https://cve.now/CVE-2026-56750): Gitea Remember-Me Token Theft Not Invalidating Attacker Session

- Severity: Critical 9.1
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-56657](https://cve.now/CVE-2026-56657): Gitea SSH Key Parser Denial of Service

- Severity: Medium 6.2
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-56654](https://cve.now/CVE-2026-56654): Privilege Escalation via Access Token Scope Escalation in API

- Severity: Critical 9.8
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-56443](https://cve.now/CVE-2026-56443): Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

- Severity: Critical 9.6
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-55987](https://cve.now/CVE-2026-55987): OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

- Severity: High 8.1
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-55984](https://cve.now/CVE-2026-55984): Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

- Severity: Low 2.7
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-55982](https://cve.now/CVE-2026-55982): OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

- Severity: Critical 9.1
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-54481](https://cve.now/CVE-2026-54481): Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

- Severity: High 7.5
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-50105](https://cve.now/CVE-2026-50105): RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

- Severity: Medium 4.3
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-42931](https://cve.now/CVE-2026-42931): Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

- Severity: Medium 6.5
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-23603](https://cve.now/CVE-2026-23603): Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

- Severity: Low 3.1
- Published: Aug 13, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 31 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-34966](https://cve.now/CVE-2026-34966): Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

- Severity: High 8.3
- Published: Aug 5, 2026
- Affected: fixed in 1.27.0.
- Fixed in v1.27.0 (released Jul 13, 2026, 23 days before disclosure).
- The latest release, v1.27.3, is not affected.

### [CVE-2026-28740](https://cve.now/CVE-2026-28740): Gitea LFS object reuse bypasses Code-unit authorization

- Severity: High 7.1
- Published: Jul 3, 2026
- Affected: fixed in 1.26.3.
- Fixed in v1.27.0 (released Jul 13, 2026, 10 days after disclosure, the advisory names 1.26.3, which was never published).
- The latest release, v1.27.3, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/gitea.dev
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.