Gitea vulnerabilities
210 CVEs and advisories name Gitea as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-89430Gitea push mirror SSRF and forced writes to internal Git hosts
- CVE-2026-103670Gitea trusted workflow cancellation by unapproved fork runs
- CVE-2026-103667Gitea container registry stored XSS through blob media type
- CVE-2026-101029Gitea migration and pull mirror SSRF through multi-answer DNS
- CVE-2026-101027Gitea migration SSRF through ALLOWED_DOMAINS address check bypass
- CVE-2026-104626Gitea fork workflow job revival through later approval
- CVE-2026-103059Gitea built-in SSH server authentication bypass through key case folding
- CVE-2026-104632Gitea fork workflow approval bypass through cancel and rerun
- CVE-2026-60004Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- CVE-2026-24059Gitea runner registration-token GET endpoint performs a write under a read-only token scope
- CVE-2026-24791Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
- CVE-2026-59765SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
- CVE-2026-59763Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
- CVE-2026-58511Webhook Authorization Header Returned in Plaintext via API
- CVE-2026-58510GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
- CVE-2026-58508Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
- CVE-2026-58507Private Repository Existence Disclosure via go-get Meta Endpoint
- CVE-2026-58445Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
- CVE-2026-58444Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
- CVE-2026-58443Public-only repository tokens can update private PR head branches
- CVE-2026-58442Repository migration SSRF via multi-answer DNS allow-list bypass
- CVE-2026-58441SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
- CVE-2026-58440Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
- CVE-2026-58439Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
- CVE-2026-58438Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
- CVE-2026-58437Repository Visibility Manipulation via Git Push Options
- CVE-2026-58436ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
- CVE-2026-58435Gitea LFS Deploy-Key Privilege Escalation
- CVE-2026-58434Private Repository Metadata Remains Accessible After Access Revocation
- CVE-2026-58433Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting