# cve.now: Gitea

The newest entries naming Gitea as an affected vendor (up to 200), of 210 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119627](https://cve.now/CVE-2026-119627.md): Gitea limited-visibility profile disclosure with public-only tokens (CVSS 4.3)
- [CVE-2026-119625](https://cve.now/CVE-2026-119625.md): Gitea user and organization feed token scope bypass (CVSS 4.3)
- [CVE-2026-119533](https://cve.now/CVE-2026-119533.md): Gitea private pull request disclosure on project boards (CVSS 7.5)
- [CVE-2026-119441](https://cve.now/CVE-2026-119441.md): Gitea public-only token bypass on bulk organization repository deletion (CVSS 7.5)
- [CVE-2026-118504](https://cve.now/CVE-2026-118504.md): Gitea issue changes on archived repositories through the API (CVSS 6.5)
- [CVE-2026-118395](https://cve.now/CVE-2026-118395.md): Gitea public-only token bypass in repository and organization creation (CVSS 7.5)
- [CVE-2026-118394](https://cve.now/CVE-2026-118394.md): Gitea OAuth2 userinfo private group disclosure to public-only tokens (CVSS 4.3)
- [CVE-2026-117685](https://cve.now/CVE-2026-117685.md): Gitea public-only package token access to private OCI blobs (CVSS 9.1)
- [CVE-2026-117677](https://cve.now/CVE-2026-117677.md): Gitea Helm chart upload decompression denial of service (CVSS 6.5)
- [CVE-2026-117649](https://cve.now/CVE-2026-117649.md): Gitea private issue disclosure through issue dependency timeline events (CVSS 3.5)
- [CVE-2026-117646](https://cve.now/CVE-2026-117646.md): Gitea private repository listing to public-only tokens on profiles (CVSS 4.3)
- [CVE-2026-117635](https://cve.now/CVE-2026-117635.md): Gitea admin API public-only token scope bypass (CVSS 6.5)
- [CVE-2026-116474](https://cve.now/CVE-2026-116474.md): Gitea Actions job token spoofing of instance-signed commits (CVSS 6.5)
- [CVE-2026-116296](https://cve.now/CVE-2026-116296.md): Gitea archived repository release, milestone and label modification (CVSS 6.5)
- [CVE-2026-116289](https://cve.now/CVE-2026-116289.md): Gitea public-only token bypass through Actions runner registration (CVSS 9.1)
- [CVE-2026-114199](https://cve.now/CVE-2026-114199.md): Gitea contribution heatmap private activity disclosure to public-only tokens (CVSS 5.3)
- [CVE-2026-113429](https://cve.now/CVE-2026-113429.md): Gitea stored XSS through legacy Actions artifact Content-Encoding (CVSS 5.4)
- [CVE-2026-112887](https://cve.now/CVE-2026-112887.md): Gitea Actions task token private repository enumeration (CVSS 4.3)
- [CVE-2026-120263](https://cve.now/CVE-2026-120263.md): Gitea OAuth2 account auto-linking takeover through the sign-up form (CVSS 9.8)
- [CVE-2026-118386](https://cve.now/CVE-2026-118386.md): Gitea Actions fork workflow trust through pull request review commit (CVSS 6.5)
- [CVE-2026-97859](https://cve.now/CVE-2026-97859.md): Gitea API disclosure of private user social graph, keys and stars (CVSS 6.5)
- [CVE-2026-97204](https://cve.now/CVE-2026-97204.md): Gitea label deletion across repository and organization IDs (CVSS 3.1)
- [CVE-2026-110494](https://cve.now/CVE-2026-110494.md): Gitea release attachment re-linking of issue attachments (CVSS 6.3)
- [CVE-2026-110324](https://cve.now/CVE-2026-110324.md): Gitea private profile information disclosure through POST request (CVSS 6.5)
- [CVE-2026-110311](https://cve.now/CVE-2026-110311.md): Gitea draft release creation disclosing attachment metadata (CVSS 4.3)
- [CVE-2026-109844](https://cve.now/CVE-2026-109844.md): Gitea watched repositories API disclosure after access revocation (CVSS 4.3)
- [CVE-2026-107686](https://cve.now/CVE-2026-107686.md): Gitea reactions accepted on locked issues and comments (CVSS 4.3)
- [CVE-2026-107618](https://cve.now/CVE-2026-107618.md): Gitea cross-site request forgery on repository topics (CVSS 8.1)
- [CVE-2026-105964](https://cve.now/CVE-2026-105964.md): Gitea Actions artifact v4 API unbounded request body (CVSS 6.5)
- [CVE-2026-105661](https://cve.now/CVE-2026-105661.md): Gitea panic on the repositories route of individual users (CVSS 5.3)
- [CVE-2026-109553](https://cve.now/CVE-2026-109553.md): Gitea SSH certificate principal impersonation of other users (CVSS 7.5)
- [CVE-2026-104627](https://cve.now/CVE-2026-104627.md): Gitea OpenID account linking without session binding (CVSS 5.4)
- [CVE-2026-78433](https://cve.now/CVE-2026-78433.md): Gitea private attachment disclosure through repository mismatch (CVSS 5.9)
- [CVE-2026-78231](https://cve.now/CVE-2026-78231.md): Gitea blind SSRF through OpenID assertion verification (CVSS 5.3)
- [CVE-2026-73814](https://cve.now/CVE-2026-73814.md): Gitea repository ownership escalation by administrators (CVSS 6.5)
- [CVE-2026-73804](https://cve.now/CVE-2026-73804.md): Gitea API token scope escalation through HTTP signatures (CVSS 8.1)
- [CVE-2026-73802](https://cve.now/CVE-2026-73802.md): Gitea Runner host isolation bypass through container options (CVSS 8.8)
- [CVE-2026-73800](https://cve.now/CVE-2026-73800.md): Gitea reusable workflow secret exposure in pull\_request\_target (CVSS 8.8)
- [CVE-2026-73539](https://cve.now/CVE-2026-73539.md): Gitea external renderer argument injection and code execution (CVSS 7.5)
- [CVE-2026-73535](https://cve.now/CVE-2026-73535.md): Gitea second-factor bypass through OpenID identity linking (CVSS 8.8)
- [CVE-2026-73273](https://cve.now/CVE-2026-73273.md): Gitea Maven checksum upload quota bypass and memory exhaustion (CVSS 4.3)
- [CVE-2026-73135](https://cve.now/CVE-2026-73135.md): Gitea hidden-owner repository listing disclosure (CVSS 5.3)
- [CVE-2026-73130](https://cve.now/CVE-2026-73130.md): Gitea repository initialization resource exhaustion (CVSS 4.3)
- [CVE-2026-73126](https://cve.now/CVE-2026-73126.md): Gitea private workflow badge token scope bypass (CVSS 4.3)
- [CVE-2026-71301](https://cve.now/CVE-2026-71301.md): Gitea private pull request title disclosure through markup (CVSS 4.3)
- [CVE-2026-71184](https://cve.now/CVE-2026-71184.md): Gitea fork workflow approval bypass through review events (CVSS 8.8)
- [CVE-2026-70407](https://cve.now/CVE-2026-70407.md): Gitea organization listing token scope bypass (CVSS 4.3)
- [CVE-2026-70406](https://cve.now/CVE-2026-70406.md): Gitea private comparison disclosure with public-only tokens (CVSS 6.5)
- [CVE-2026-70402](https://cve.now/CVE-2026-70402.md): Gitea local code execution through writable Git hooks (CVSS 5.8)
- [CVE-2026-70400](https://cve.now/CVE-2026-70400.md): Gitea private migration creation with public-only tokens (CVSS 5.4)
- [CVE-2026-70396](https://cve.now/CVE-2026-70396.md): Gitea organization repository creation token scope bypass (CVSS 5.4)
- [CVE-2026-68964](https://cve.now/CVE-2026-68964.md): Gitea restricted-user SSH and GPG key metadata disclosure (CVSS 4.3)
- [CVE-2026-68957](https://cve.now/CVE-2026-68957.md): Gitea restricted-user issue search disclosure (CVSS 4.3)
- [CVE-2026-67577](https://cve.now/CVE-2026-67577.md): Gitea restricted-user activity and heatmap disclosure (CVSS 4.3)
- [CVE-2026-66877](https://cve.now/CVE-2026-66877.md): Gitea fork workflow approval bypass through concurrency cancellation (CVSS 8.1)
- [CVE-2026-66874](https://cve.now/CVE-2026-66874.md): Gitea required Actions check bypass through skipped workflows (CVSS 6.5)
- [CVE-2026-66853](https://cve.now/CVE-2026-66853.md): Gitea restricted-user organization metadata disclosure (CVSS 4.3)
- [CVE-2026-66849](https://cve.now/CVE-2026-66849.md): Gitea restricted-user package visibility bypass (CVSS 4.3)
- [CVE-2026-63792](https://cve.now/CVE-2026-63792.md): Gitea private reusable workflow disclosure to fork runs (CVSS 5.3)
- [CVE-2026-63021](https://cve.now/CVE-2026-63021.md): Gitea Swift package manifest memory exhaustion (CVSS 6.5)
- [CVE-2026-62925](https://cve.now/CVE-2026-62925.md): Gitea Alpine package parsing memory exhaustion (CVSS 6.5)
- [CVE-2026-60021](https://cve.now/CVE-2026-60021.md): Gitea GitLab migration denial of service (CVSS 6.5)
- [CVE-2026-60018](https://cve.now/CVE-2026-60018.md): Gitea OneDev migration denial of service (CVSS 6.5)
- [CVE-2026-60010](https://cve.now/CVE-2026-60010.md): Gitea organization team policy bypass through repository API (CVSS 6.5)
- [CVE-2026-60008](https://cve.now/CVE-2026-60008.md): Gitea Jupyter notebook UI redress through CSS class injection (CVSS 3.5)
- [CVE-2026-59774](https://cve.now/CVE-2026-59774.md): Gitea Org-mode file disclosure and code execution (CVSS 9.8)
- [CVE-2026-59766](https://cve.now/CVE-2026-59766.md): Gitea private repository metadata disclosure after access revocation (CVSS 4.3)
- [CVE-2026-25946](https://cve.now/CVE-2026-25946.md): Gitea OpenID discovery server-side request forgery (CVSS 5.3)
- [CVE-2026-97626](https://cve.now/CVE-2026-97626.md): Gitea profile feed disclosure bypassing user visibility (CVSS 4.3)
- [CVE-2026-96594](https://cve.now/CVE-2026-96594.md): Gitea repository media API stored XSS (CVSS 6.1)
- [CVE-2026-89182](https://cve.now/CVE-2026-89182.md): Gitea push-to-create bypass of FORCE\_PRIVATE policy (CVSS 5.4)
- [CVE-2026-105268](https://cve.now/CVE-2026-105268.md): Gitea issue attachment API allows changing comment attachments (CVSS 4.3)
- [CVE-2026-105267](https://cve.now/CVE-2026-105267.md): Gitea tag delete route deletes releases without release permission (CVSS 8.1)
- [CVE-2026-104633](https://cve.now/CVE-2026-104633.md): Gitea migration memory exhaustion from zero page size (CVSS 6.5)
- [CVE-2026-101023](https://cve.now/CVE-2026-101023.md): Gitea OAuth2 refresh token grant accepts access tokens (CVSS 9.1)
- [CVE-2026-97208](https://cve.now/CVE-2026-97208.md): Gitea push mirror API bypass of DISABLE\_NEW\_PUSH policy (CVSS 4.9)
- [CVE-2026-86684](https://cve.now/CVE-2026-86684.md): Gitea push mirror local path check uses the repository owner (CVSS 7.1)
- [CVE-2026-73278](https://cve.now/CVE-2026-73278.md): Gitea WebAuthn bypass during OAuth and OIDC sign-in (CVSS 9.8)
- [CVE-2026-96589](https://cve.now/CVE-2026-96589.md): Gitea private repository access retained after rejected transfer (CVSS 4.3)
- [CVE-2026-96580](https://cve.now/CVE-2026-96580.md): Gitea Actions memory exhaustion through large static matrices (CVSS 7.5)
- [CVE-2026-96404](https://cve.now/CVE-2026-96404.md): Gitea installer authentication bypass for existing accounts (CVSS 8.1)
- [CVE-2026-96400](https://cve.now/CVE-2026-96400.md): Gitea migration SSRF to reserved addresses through ALLOWED\_DOMAINS (CVSS 4.3)
- [CVE-2026-96399](https://cve.now/CVE-2026-96399.md): Gitea denial of service through external issue tracker patterns (CVSS 7.5)
- [CVE-2026-95112](https://cve.now/CVE-2026-95112.md): Gitea issue reference parsing CPU exhaustion (CVSS 6.5)
- [CVE-2026-94205](https://cve.now/CVE-2026-94205.md): Gitea fork workflow approval bypass through maintainer-triggered events (CVSS 9.8)
- [CVE-2026-79960](https://cve.now/CVE-2026-79960.md): Gitea deploy key pushes acting as the repository owner (CVSS 7.1)
- [CVE-2026-70357](https://cve.now/CVE-2026-70357.md): Gitea repository migration SSRF through DNS rebinding (CVSS 7.5)
- [CVE-2026-104636](https://cve.now/CVE-2026-104636.md): Gitea SSRF through Git HTTP redirects in mirrors and fetches (CVSS 7.5)
- [CVE-2026-103504](https://cve.now/CVE-2026-103504.md): Gitea API team demotion not applied to unit permissions (CVSS 8.1)
- [CVE-2026-95106](https://cve.now/CVE-2026-95106.md): Gitea review and execution mismatch through duplicate tree entries (CVSS 9.1)
- [CVE-2026-89430](https://cve.now/CVE-2026-89430.md): Gitea push mirror SSRF and forced writes to internal Git hosts (CVSS 8.1)
- [CVE-2026-103670](https://cve.now/CVE-2026-103670.md): Gitea trusted workflow cancellation by unapproved fork runs (CVSS 7.5)
- [CVE-2026-103667](https://cve.now/CVE-2026-103667.md): Gitea container registry stored XSS through blob media type (CVSS 5.4)
- [CVE-2026-101029](https://cve.now/CVE-2026-101029.md): Gitea migration and pull mirror SSRF through multi-answer DNS (CVSS 4.3)
- [CVE-2026-101027](https://cve.now/CVE-2026-101027.md): Gitea migration SSRF through ALLOWED\_DOMAINS address check bypass (CVSS 7.7)
- [CVE-2026-104626](https://cve.now/CVE-2026-104626.md): Gitea fork workflow job revival through later approval (CVSS 8.8)
- [CVE-2026-103059](https://cve.now/CVE-2026-103059.md): Gitea built-in SSH server authentication bypass through key case folding (CVSS 9.1)
- [CVE-2026-104632](https://cve.now/CVE-2026-104632.md): Gitea fork workflow approval bypass through cancel and rerun (CVSS 8.8)
- [CVE-2026-60004](https://cve.now/CVE-2026-60004.md): Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. (CVSS 9.8, KEV)
- [CVE-2026-24059](https://cve.now/CVE-2026-24059.md): Gitea runner registration-token GET endpoint performs a write under a read-only token scope (CVSS 6.5)
- [CVE-2026-24791](https://cve.now/CVE-2026-24791.md): Public-only tokens bypass private-resource restrictions on \`/api/v1/user\` self routes (CVSS 8.1)
- [CVE-2026-59765](https://cve.now/CVE-2026-59765.md): SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata (CVSS 7.5)
- [CVE-2026-59763](https://cve.now/CVE-2026-59763.md): Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads (CVSS 4.3)
- [CVE-2026-58511](https://cve.now/CVE-2026-58511.md): Webhook Authorization Header Returned in Plaintext via API (CVSS 2.7)
- [CVE-2026-58510](https://cve.now/CVE-2026-58510.md): GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-\>private (CVSS 4.3)
- [CVE-2026-58508](https://cve.now/CVE-2026-58508.md): Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) (CVSS 9.1)
- [CVE-2026-58507](https://cve.now/CVE-2026-58507.md): Private Repository Existence Disclosure via go-get Meta Endpoint (CVSS 5.3)
- [CVE-2026-58445](https://cve.now/CVE-2026-58445.md): Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API (CVSS 2.7)
- [CVE-2026-58444](https://cve.now/CVE-2026-58444.md): Personal access token scope enforcement bypass on the repository home page (\`GET /{owner}/{repo}\`) discloses private repository contents (CVSS 4.3)
- [CVE-2026-58443](https://cve.now/CVE-2026-58443.md): Public-only repository tokens can update private PR head branches (CVSS 9.1)
- [CVE-2026-58442](https://cve.now/CVE-2026-58442.md): Repository migration SSRF via multi-answer DNS allow-list bypass (CVSS 6.5)
- [CVE-2026-58441](https://cve.now/CVE-2026-58441.md): SSRF in restore-repo via unsanitized pull\_request.yml Head.CloneURL (CVSS 6.3)
- [CVE-2026-58440](https://cve.now/CVE-2026-58440.md): Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in \`DeleteCollaboration\`) (CVSS 6.8)
- [CVE-2026-58439](https://cve.now/CVE-2026-58439.md): Branch Protection Bypass via PR Retargeting Preserves Stale \`official\` Approval Flag (CVSS 8.1)
- [CVE-2026-58438](https://cve.now/CVE-2026-58438.md): Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access (CVSS 7.5)
- [CVE-2026-58437](https://cve.now/CVE-2026-58437.md): Repository Visibility Manipulation via Git Push Options (CVSS 7.1)
- [CVE-2026-58436](https://cve.now/CVE-2026-58436.md): ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests (CVSS 7.5)
- [CVE-2026-58435](https://cve.now/CVE-2026-58435.md): Gitea LFS Deploy-Key Privilege Escalation (CVSS 5.4)
- [CVE-2026-58434](https://cve.now/CVE-2026-58434.md): Private Repository Metadata Remains Accessible After Access Revocation (CVSS 7.5)
- [CVE-2026-58433](https://cve.now/CVE-2026-58433.md): Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting (CVSS 9.1)
- [CVE-2026-58432](https://cve.now/CVE-2026-58432.md): Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea (CVSS 5.9)
- [CVE-2026-58431](https://cve.now/CVE-2026-58431.md): Public-only API token restriction is not enforced on team API routes (CVSS 4.3)
- [CVE-2026-58429](https://cve.now/CVE-2026-58429.md): Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints (CVSS 4.9)
- [CVE-2026-58428](https://cve.now/CVE-2026-58428.md): Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) (CVSS 6.5)
- [CVE-2026-58427](https://cve.now/CVE-2026-58427.md): Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 (CVSS 7.5)
- [CVE-2026-58425](https://cve.now/CVE-2026-58425.md): OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) (CVSS 4.3)
- [CVE-2026-58420](https://cve.now/CVE-2026-58420.md): Local File Inclusion via file:// URI in Migration Restore (CVSS 4.4)
- [CVE-2026-58417](https://cve.now/CVE-2026-58417.md): REST API exposes organization membership of private organizations to public (CVSS 7.5)
- [CVE-2026-58416](https://cve.now/CVE-2026-58416.md): Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) (CVSS 7.1)
- [CVE-2026-58314](https://cve.now/CVE-2026-58314.md): Two SSRF findings in Gitea 1.26.2 (CVSS 7.7)
- [CVE-2026-57897](https://cve.now/CVE-2026-57897.md): Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs (CVSS 6.5)
- [CVE-2026-57894](https://cve.now/CVE-2026-57894.md): Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration (CVSS 8.5)
- [CVE-2026-57886](https://cve.now/CVE-2026-57886.md): Cross-repository issue/comment attachment re-linking can expose private attachment content (CVSS 5.9)
- [CVE-2026-56755](https://cve.now/CVE-2026-56755.md): Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload (CVSS 6.2)
- [CVE-2026-56750](https://cve.now/CVE-2026-56750.md): Gitea Remember-Me Token Theft Not Invalidating Attacker Session (CVSS 9.1)
- [CVE-2026-56657](https://cve.now/CVE-2026-56657.md): Gitea SSH Key Parser Denial of Service (CVSS 6.2)
- [CVE-2026-56654](https://cve.now/CVE-2026-56654.md): Privilege Escalation via Access Token Scope Escalation in API (CVSS 9.8)
- [CVE-2026-56443](https://cve.now/CVE-2026-56443.md): Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 (CVSS 9.6)
- [CVE-2026-55987](https://cve.now/CVE-2026-55987.md): OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) (CVSS 8.1)
- [CVE-2026-55986](https://cve.now/CVE-2026-55986.md): Email Management API Bypasses ManageCredentials Feature Restrictions (CVSS 5.4)
- [CVE-2026-55984](https://cve.now/CVE-2026-55984.md): Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service (CVSS 2.7)
- [CVE-2026-55982](https://cve.now/CVE-2026-55982.md): OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes (CVSS 9.1)
- [CVE-2026-54481](https://cve.now/CVE-2026-54481.md): Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) (CVSS 7.5)
- [CVE-2026-50105](https://cve.now/CVE-2026-50105.md): RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) (CVSS 4.3)
- [CVE-2026-42931](https://cve.now/CVE-2026-42931.md): Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint (CVSS 6.5)
- [CVE-2026-23603](https://cve.now/CVE-2026-23603.md): Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim (CVSS 3.1)
- [CVE-2026-34966](https://cve.now/CVE-2026-34966.md): Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass (CVSS 8.3)
- [CVE-2026-58426](https://cve.now/CVE-2026-58426.md): Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write (CVSS 9.6)
- [CVE-2026-58424](https://cve.now/CVE-2026-58424.md): Permanent Fork PR Workflow Approval Gate Bypass (CVSS 8.9)
- [CVE-2026-58423](https://cve.now/CVE-2026-58423.md): LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories (CVSS 7.7)
- [CVE-2026-58422](https://cve.now/CVE-2026-58422.md): Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts (CVSS 9.8)
- [CVE-2026-58421](https://cve.now/CVE-2026-58421.md): Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service (CVSS 7.5)
- [CVE-2026-58419](https://cve.now/CVE-2026-58419.md): Notification API leaks private issue metadata after access revocation (CVSS 7.5)
- [CVE-2026-58418](https://cve.now/CVE-2026-58418.md): SSRF via HTTP Redirect in Repository Migration (CVSS 6.5)
- [CVE-2026-28744](https://cve.now/CVE-2026-28744.md): Gitea Git smart HTTP bypasses repository token scopes for bearer tokens (CVSS 8.1)
- [CVE-2026-28740](https://cve.now/CVE-2026-28740.md): Gitea LFS object reuse bypasses Code-unit authorization (CVSS 7.1)
- [CVE-2026-28737](https://cve.now/CVE-2026-28737.md): Gitea 3D file viewer allows stored XSS through glTF extensionsRequired (CVSS 8.7)
- [CVE-2026-28705](https://cve.now/CVE-2026-28705.md): Gitea repository dumps write release assets using unsafe path names (CVSS 5.3)
- [CVE-2026-28699](https://cve.now/CVE-2026-28699.md): Gitea Basic Auth bypasses OAuth2 access token scopes (CVSS 8.1)
- [CVE-2026-27783](https://cve.now/CVE-2026-27783.md): Gitea issue-template APIs bypass repository unit authorization (CVSS 4.3)
- [CVE-2026-27780](https://cve.now/CVE-2026-27780.md): Gitea pre-receive hook can miss branch-protection checks after scanner errors (CVSS 9.8)
- [CVE-2026-27779](https://cve.now/CVE-2026-27779.md): Gitea forwarded-proto handling allows public URL spoofing (CVSS 7.5)
- [CVE-2026-27775](https://cve.now/CVE-2026-27775.md): Gitea pre-receive hook permission cache allows full repository write access (CVSS 8.8)
- [CVE-2026-27771](https://cve.now/CVE-2026-27771.md): Gitea Composer package source links use insufficient permission checks (CVSS 8.2)
- [CVE-2026-27761](https://cve.now/CVE-2026-27761.md): Gitea repository feeds bypass API token scope enforcement (CVSS 4.3)
- [CVE-2026-27660](https://cve.now/CVE-2026-27660.md): Gitea draft releases use insufficient permission checks (CVSS 7.5)
- [CVE-2026-27657](https://cve.now/CVE-2026-27657.md): Gitea email settings allow changing another user's primary email address (CVSS 7.5)
- [CVE-2026-26307](https://cve.now/CVE-2026-26307.md): Gitea git grep search lacks a timeout (CVSS 7.5)
- [CVE-2026-26292](https://cve.now/CVE-2026-26292.md): Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions (CVSS 9.8)
- [CVE-2026-26247](https://cve.now/CVE-2026-26247.md): Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange (CVSS 9.1)
- [CVE-2026-26232](https://cve.now/CVE-2026-26232.md): Gitea OAuth2 authorization codes lack expiry and reuse enforcement (CVSS 9.1)
- [CVE-2026-26231](https://cve.now/CVE-2026-26231.md): Gitea maintainer-edit permissions allow unauthorized commits to readable repositories (CVSS 8.5)
- [CVE-2026-25782](https://cve.now/CVE-2026-25782.md): Gitea tracked-time deletion can target entries from another issue (CVSS 5.3)
- [CVE-2026-25779](https://cve.now/CVE-2026-25779.md): Gitea redirect handling permits open redirects through backslash paths (CVSS 6.1)
- [CVE-2026-25718](https://cve.now/CVE-2026-25718.md): Gitea template repository generation mishandles symlinked paths (CVSS 9.1)
- [CVE-2026-25714](https://cve.now/CVE-2026-25714.md): Gitea user organization API bypasses public-only token filtering (CVSS 4.3)
- [CVE-2026-25712](https://cve.now/CVE-2026-25712.md): Gitea organization permission APIs expose private visibility information (CVSS 7.5)
- [CVE-2026-25038](https://cve.now/CVE-2026-25038.md): Gitea private organization labels are visible to unauthorized users (CVSS 7.5)
- [CVE-2026-24690](https://cve.now/CVE-2026-24690.md): Gitea pull-request branch updates use insufficient permission checks (CVSS 7.5)
- [CVE-2026-24451](https://cve.now/CVE-2026-24451.md): Gitea fork synchronization can expose private parent repository data (CVSS 7.5)
- [CVE-2026-22874](https://cve.now/CVE-2026-22874.md): Gitea webhook and migration allow-list filtering permits SSRF (CVSS 9.6)
- [CVE-2026-22555](https://cve.now/CVE-2026-22555.md): Gitea organization forks can expose organization secrets without create permission (CVSS 8.1)
- [CVE-2026-22547](https://cve.now/CVE-2026-22547.md): Gitea repository creation accepts invalid field values (CVSS 9.1)
- [CVE-2026-20909](https://cve.now/CVE-2026-20909.md): Gitea tracked-time list endpoint has insufficient permission checks (CVSS 5.3)
- [CVE-2026-20896](https://cve.now/CVE-2026-20896.md): Gitea Docker image trusts spoofable reverse-proxy headers by default (CVSS 9.8)
- [CVE-2026-20779](https://cve.now/CVE-2026-20779.md): Gitea TOTP single-use enforcement defect allows OTP replay (CVSS 7.1)
- [CVE-2026-20706](https://cve.now/CVE-2026-20706.md): Gitea repository archive downloads bypass token scope checks (CVSS 9.1)
- [CVE-2026-58053](https://cve.now/CVE-2026-58053.md): Gitea act\_runner - Container Hardening Bypass via Workflow Container Options (CVSS 9.9)
- [CVE-2026-20912](https://cve.now/CVE-2026-20912.md): Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure (CVSS 9.1)
- [CVE-2026-20904](https://cve.now/CVE-2026-20904.md): Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes (CVSS 6.5)
- [CVE-2026-20897](https://cve.now/CVE-2026-20897.md): Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) (CVSS 9.1)
- [CVE-2026-20888](https://cve.now/CVE-2026-20888.md): Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass) (CVSS 4.3)
- [CVE-2026-20883](https://cve.now/CVE-2026-20883.md): Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure (CVSS 6.5)
- [CVE-2026-20800](https://cve.now/CVE-2026-20800.md): Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation (CVSS 6.5)
- [CVE-2026-20750](https://cve.now/CVE-2026-20750.md): Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR) (CVSS 9.1)
- [CVE-2026-20736](https://cve.now/CVE-2026-20736.md): Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check (CVSS 7.5)
- [CVE-2026-0798](https://cve.now/CVE-2026-0798.md): Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation (CVSS 3.5)
- [CVE-2025-69413](https://cve.now/CVE-2025-69413.md): In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. (CVSS 5.3)
- [CVE-2025-68946](https://cve.now/CVE-2025-68946.md): In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS. (CVSS 5.4)
- [CVE-2025-68945](https://cve.now/CVE-2025-68945.md): In Gitea before 1.21.2, an anonymous user can visit a private user's project. (CVSS 5.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/gitea
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.