Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/go-gitea/gitea

20 known vulnerabilities (4 critical, 5 medium), with the versions each affects and the releases that fix them.

Latest release
v1.8.3 (Jun 17, 2019): affected by 12 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
20 · 4 critical, 5 medium
Releases
63 since v0.9.99 (Oct 17, 2016)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-25779
    Affects v0.9.99 to v1.9.0-dev (through the newest release)
  • CVE-2026-20912
    Affects v0.9.99 to v1.9.0-dev (through the newest release)
  • CVE-2026-20904
    Affects v0.9.99 to v1.9.0-dev (through the newest release)
  • CVE-2026-20897
    Affects v0.9.99 to v1.9.0-dev (through the newest release)
  • CVE-2026-20888
    Affects v0.9.99 to v1.9.0-dev (through the newest release)
  • CVE-2026-20883
    Affects v0.9.99 to v1.9.0-dev (through the newest release)
  • CVE-2026-20800
    Affects v0.9.99 to v1.9.0-dev (through the newest release)
  • CVE-2026-20750
    Affects v0.9.99 to v1.9.0-dev (through the newest release)
  • CVE-2022-42968
    Affects v0.9.99 to v1.9.0-dev (through the newest release)
  • CVE-2021-45329
    Affects v0.9.99 to v1.5.0 (v1.5.1 is outside it)
  • CVE-2021-45328
    Affects v0.9.99 to v1.4.2 (v1.4.3 is outside it)
  • CVE-2021-45327
    Affects v0.9.99 to v1.9.0-dev (through the newest release)
Show all 20 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 20

  • CVE-2026-25779Medium 6.1

    Gitea redirect handling permits open redirects through backslash paths

    Affected: fixed in 1.26.0.

    No fix released. The advisory names 1.26.0 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected.

  • CVE-2026-20912Critical 9.1

    Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure

    Affected: fixed in 1.25.4.

    No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected.

  • CVE-2026-20904Medium 6.5

    Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes

    Affected: fixed in 1.25.4.

    No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected.

  • CVE-2026-20897Critical 9.1

    Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)

    Affected: fixed in 1.25.4.

    No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected.

  • CVE-2026-20888Medium 4.3

    Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)

    Affected: fixed in 1.25.4.

    No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected.

  • CVE-2026-20883Medium 6.5

    Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure

    Affected: fixed in 1.25.4.

    No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected.

  • CVE-2026-20800Medium 6.5

    Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation

    Affected: fixed in 1.25.4.

    No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected.

  • CVE-2026-20750Critical 9.1

    Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)

    Affected: fixed in 1.25.4.

    No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected.

  • CVE-2022-42968Critical 9.8

    Gitea before 1.17.3 does not sanitize and escape refs in the git backend.

    Affected: fixed in 1.17.3.

    No fix released. The advisory names 1.17.3 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected.

  • Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker…

    Affected: fixed in 1.5.1.

    Fixed in v1.5.1 (released Sep 3, 2018, 1254 days before disclosure).

    The latest release, v1.8.3, is not affected.

  • Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.

    Affected: fixed in 1.4.3.

    Fixed in v1.4.3 (released Jun 26, 2018, 1323 days before disclosure).

    The latest release, v1.8.3, is not affected.

  • Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API.

    Affected: fixed in 1.11.2.

    No fix released. The advisory names 1.11.2 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected.

  • Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state…

    Affected: fixed in 1.5.2.

    Fixed in v1.5.2 (released Oct 9, 2018, 1218 days before disclosure).

    The latest release, v1.8.3, is not affected.

  • Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.

    Affected: fixed in 1.7.0.

    Fixed in v1.7.0 (released Jan 22, 2019, 1113 days before disclosure).

    The latest release, v1.8.3, is not affected.

  • Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors…

    Affected: from 1.9.0, fixed in 1.13.2.

    No fix released. The advisory names 1.13.2 as the fix, which the registry doesn't have yet.

Show all 20 advisoriesShow fewer advisories

  • Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines…

    Affected: from 0.9.99, fixed in 1.12.6.

    No fix released. The advisory names 1.12.6 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected.

  • An issue was discovered in Gitea through 1.11.5.

    Affected: fixed in 1.12.0.

    No fix released. The advisory names 1.12.0 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected.

  • models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.

    Affected: fixed in 1.7.6.

    Fixed in v1.7.6 (released Apr 13, 2019, the day of disclosure).

    The latest release, v1.8.3, is not affected.

  • repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress.

    Affected: fixed in 1.7.6.

    Fixed in v1.7.6 (released Apr 13, 2019, the day of disclosure).

    The latest release, v1.8.3, is not affected.

  • Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses.

    Affected: fixed in 1.5.1.

    Fixed in v1.5.1 (released Sep 3, 2018, 35 days before disclosure).

    The latest release, v1.8.3, is not affected.