Gitea vulnerabilities
210 CVEs and advisories name Gitea as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-119627Gitea limited-visibility profile disclosure with public-only tokens
- CVE-2026-119625Gitea user and organization feed token scope bypass
- CVE-2026-119533Gitea private pull request disclosure on project boards
- CVE-2026-119441Gitea public-only token bypass on bulk organization repository deletion
- CVE-2026-118504Gitea issue changes on archived repositories through the API
- CVE-2026-118395Gitea public-only token bypass in repository and organization creation
- CVE-2026-118394Gitea OAuth2 userinfo private group disclosure to public-only tokens
- CVE-2026-117685Gitea public-only package token access to private OCI blobs
- CVE-2026-117677Gitea Helm chart upload decompression denial of service
- CVE-2026-117649Gitea private issue disclosure through issue dependency timeline events
- CVE-2026-117646Gitea private repository listing to public-only tokens on profiles
- CVE-2026-117635Gitea admin API public-only token scope bypass
- CVE-2026-116474Gitea Actions job token spoofing of instance-signed commits
- CVE-2026-116296Gitea archived repository release, milestone and label modification
- CVE-2026-116289Gitea public-only token bypass through Actions runner registration
- CVE-2026-114199Gitea contribution heatmap private activity disclosure to public-only tokens
- CVE-2026-113429Gitea stored XSS through legacy Actions artifact Content-Encoding
- CVE-2026-112887Gitea Actions task token private repository enumeration
- CVE-2026-120263Gitea OAuth2 account auto-linking takeover through the sign-up form
- CVE-2026-118386Gitea Actions fork workflow trust through pull request review commit
- CVE-2026-97859Gitea API disclosure of private user social graph, keys and stars
- CVE-2026-97204Gitea label deletion across repository and organization IDs
- CVE-2026-110494Gitea release attachment re-linking of issue attachments
- CVE-2026-110324Gitea private profile information disclosure through POST request
- CVE-2026-110311Gitea draft release creation disclosing attachment metadata
- CVE-2026-109844Gitea watched repositories API disclosure after access revocation
- CVE-2026-107686Gitea reactions accepted on locked issues and comments
- CVE-2026-107618Gitea cross-site request forgery on repository topics
- CVE-2026-105964Gitea Actions artifact v4 API unbounded request body
- CVE-2026-105661Gitea panic on the repositories route of individual users