# github.com/go-gitea/gitea (Go) vulnerabilities 20 known vulnerabilities (4 critical, 5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.8.3 (Jun 17, 2019): affected by 12 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 63 since v0.9.99 (Oct 17, 2016) - Registry: https://pkg.go.dev/github.com/go-gitea/gitea - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-25779: v0.9.99 to v1.9.0-dev (through the newest release) - CVE-2026-20912: v0.9.99 to v1.9.0-dev (through the newest release) - CVE-2026-20904: v0.9.99 to v1.9.0-dev (through the newest release) - CVE-2026-20897: v0.9.99 to v1.9.0-dev (through the newest release) - CVE-2026-20888: v0.9.99 to v1.9.0-dev (through the newest release) - CVE-2026-20883: v0.9.99 to v1.9.0-dev (through the newest release) - CVE-2026-20800: v0.9.99 to v1.9.0-dev (through the newest release) - CVE-2026-20750: v0.9.99 to v1.9.0-dev (through the newest release) - CVE-2022-42968: v0.9.99 to v1.9.0-dev (through the newest release) - CVE-2021-45329: v0.9.99 to v1.5.0 (v1.5.1 is outside it) - CVE-2021-45328: v0.9.99 to v1.4.2 (v1.4.3 is outside it) - CVE-2021-45327: v0.9.99 to v1.9.0-dev (through the newest release) - CVE-2021-45326: v0.9.99 to v1.5.1 (v1.5.2 is outside it) - CVE-2021-45325: v0.9.99 to v1.7.0-rc3 (v1.7.0 is outside it) - CVE-2021-3382: no published release is affected - CVE-2020-28991: v0.9.99 to v1.9.0-dev (through the newest release) - CVE-2020-13246: v0.9.99 to v1.9.0-dev (through the newest release) - CVE-2019-11229: v0.9.99 to v1.7.5 (v1.7.6 is outside it) - CVE-2019-11228: v0.9.99 to v1.7.5 (v1.7.6 is outside it) - CVE-2018-1000803: v0.9.99 to v1.5.0 (v1.5.1 is outside it) ## Advisories (20) ### [CVE-2026-25779](https://cve.now/CVE-2026-25779): Gitea redirect handling permits open redirects through backslash paths - Severity: Medium 6.1 - Published: Jul 3, 2026 - Affected: fixed in 1.26.0. - No fix released. The advisory names 1.26.0 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected. ### [CVE-2026-20912](https://cve.now/CVE-2026-20912): Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure - Severity: Critical 9.1 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected. ### [CVE-2026-20904](https://cve.now/CVE-2026-20904): Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes - Severity: Medium 6.5 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected. ### [CVE-2026-20897](https://cve.now/CVE-2026-20897): Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) - Severity: Critical 9.1 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected. ### [CVE-2026-20888](https://cve.now/CVE-2026-20888): Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass) - Severity: Medium 4.3 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected. ### [CVE-2026-20883](https://cve.now/CVE-2026-20883): Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure - Severity: Medium 6.5 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected. ### [CVE-2026-20800](https://cve.now/CVE-2026-20800): Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation - Severity: Medium 6.5 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected. ### [CVE-2026-20750](https://cve.now/CVE-2026-20750): Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR) - Severity: Critical 9.1 - Published: Jan 22, 2026 - Affected: fixed in 1.25.4. - No fix released. The advisory names 1.25.4 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected. ### [CVE-2022-42968](https://cve.now/CVE-2022-42968): Gitea before 1.17.3 does not sanitize and escape refs in the git backend. - Severity: Critical 9.8 - Published: Oct 16, 2022 - Affected: fixed in 1.17.3. - No fix released. The advisory names 1.17.3 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected. ### [CVE-2021-45329](https://cve.now/CVE-2021-45329): Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker… - Severity: Unrated - Published: Feb 8, 2022 - Affected: fixed in 1.5.1. - Fixed in v1.5.1 (released Sep 3, 2018, 1254 days before disclosure). - The latest release, v1.8.3, is not affected. ### [CVE-2021-45328](https://cve.now/CVE-2021-45328): Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. - Severity: Unrated - Published: Feb 8, 2022 - Affected: fixed in 1.4.3. - Fixed in v1.4.3 (released Jun 26, 2018, 1323 days before disclosure). - The latest release, v1.8.3, is not affected. ### [CVE-2021-45327](https://cve.now/CVE-2021-45327): Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. - Severity: Unrated - Published: Feb 8, 2022 - Affected: fixed in 1.11.2. - No fix released. The advisory names 1.11.2 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected. ### [CVE-2021-45326](https://cve.now/CVE-2021-45326): Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state… - Severity: Unrated - Published: Feb 8, 2022 - Affected: fixed in 1.5.2. - Fixed in v1.5.2 (released Oct 9, 2018, 1218 days before disclosure). - The latest release, v1.8.3, is not affected. ### [CVE-2021-45325](https://cve.now/CVE-2021-45325): Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL. - Severity: Unrated - Published: Feb 8, 2022 - Affected: fixed in 1.7.0. - Fixed in v1.7.0 (released Jan 22, 2019, 1113 days before disclosure). - The latest release, v1.8.3, is not affected. ### [CVE-2021-3382](https://cve.now/CVE-2021-3382): Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors… - Severity: Unrated - Published: Feb 5, 2021 - Affected: from 1.9.0, fixed in 1.13.2. - No fix released. The advisory names 1.13.2 as the fix, which the registry doesn't have yet. ### [CVE-2020-28991](https://cve.now/CVE-2020-28991): Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines… - Severity: Unrated - Published: Nov 24, 2020 - Affected: from 0.9.99, fixed in 1.12.6. - No fix released. The advisory names 1.12.6 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected. ### [CVE-2020-13246](https://cve.now/CVE-2020-13246): An issue was discovered in Gitea through 1.11.5. - Severity: Unrated - Published: May 20, 2020 - Affected: fixed in 1.12.0. - No fix released. The advisory names 1.12.0 as the fix, which the registry doesn't have yet. The latest release, v1.8.3, is still affected. ### [CVE-2019-11229](https://cve.now/CVE-2019-11229): models/repo\_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution. - Severity: Unrated - Published: Apr 13, 2019 - Affected: fixed in 1.7.6. - Fixed in v1.7.6 (released Apr 13, 2019, the day of disclosure). - The latest release, v1.8.3, is not affected. ### [CVE-2019-11228](https://cve.now/CVE-2019-11228): repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. - Severity: Unrated - Published: Apr 13, 2019 - Affected: fixed in 1.7.6. - Fixed in v1.7.6 (released Apr 13, 2019, the day of disclosure). - The latest release, v1.8.3, is not affected. ### [CVE-2018-1000803](https://cve.now/CVE-2018-1000803): Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. - Severity: Unrated - Published: Oct 8, 2018 - Affected: fixed in 1.5.1. - Fixed in v1.5.1 (released Sep 3, 2018, 35 days before disclosure). - The latest release, v1.8.3, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/go-gitea/gitea Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.