Gitea vulnerabilities
210 CVEs and advisories name Gitea as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-109553Gitea SSH certificate principal impersonation of other users
- CVE-2026-104627Gitea OpenID account linking without session binding
- CVE-2026-78433Gitea private attachment disclosure through repository mismatch
- CVE-2026-78231Gitea blind SSRF through OpenID assertion verification
- CVE-2026-73814Gitea repository ownership escalation by administrators
- CVE-2026-73804Gitea API token scope escalation through HTTP signatures
- CVE-2026-73802Gitea Runner host isolation bypass through container options
- CVE-2026-73800Gitea reusable workflow secret exposure in pull_request_target
- CVE-2026-73539Gitea external renderer argument injection and code execution
- CVE-2026-73535Gitea second-factor bypass through OpenID identity linking
- CVE-2026-73273Gitea Maven checksum upload quota bypass and memory exhaustion
- CVE-2026-73135Gitea hidden-owner repository listing disclosure
- CVE-2026-73130Gitea repository initialization resource exhaustion
- CVE-2026-73126Gitea private workflow badge token scope bypass
- CVE-2026-71301Gitea private pull request title disclosure through markup
- CVE-2026-71184Gitea fork workflow approval bypass through review events
- CVE-2026-70407Gitea organization listing token scope bypass
- CVE-2026-70406Gitea private comparison disclosure with public-only tokens
- CVE-2026-70402Gitea local code execution through writable Git hooks
- CVE-2026-70400Gitea private migration creation with public-only tokens
- CVE-2026-70396Gitea organization repository creation token scope bypass
- CVE-2026-68964Gitea restricted-user SSH and GPG key metadata disclosure
- CVE-2026-68957Gitea restricted-user issue search disclosure
- CVE-2026-67577Gitea restricted-user activity and heatmap disclosure
- CVE-2026-66877Gitea fork workflow approval bypass through concurrency cancellation
- CVE-2026-66874Gitea required Actions check bypass through skipped workflows
- CVE-2026-66853Gitea restricted-user organization metadata disclosure
- CVE-2026-66849Gitea restricted-user package visibility bypass
- CVE-2026-63792Gitea private reusable workflow disclosure to fork runs
- CVE-2026-63021Gitea Swift package manifest memory exhaustion