Gitea vulnerabilities
210 CVEs and advisories name Gitea as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-58432Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
- CVE-2026-58431Public-only API token restriction is not enforced on team API routes
- CVE-2026-58429Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
- CVE-2026-58428Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
- CVE-2026-58427Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
- CVE-2026-58425OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
- CVE-2026-58420Local File Inclusion via file:// URI in Migration Restore
- CVE-2026-58417REST API exposes organization membership of private organizations to public
- CVE-2026-58416Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
- CVE-2026-58314Two SSRF findings in Gitea 1.26.2
- CVE-2026-57897Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
- CVE-2026-57894Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
- CVE-2026-57886Cross-repository issue/comment attachment re-linking can expose private attachment content
- CVE-2026-56755Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
- CVE-2026-56750Gitea Remember-Me Token Theft Not Invalidating Attacker Session
- CVE-2026-56657Gitea SSH Key Parser Denial of Service
- CVE-2026-56654Privilege Escalation via Access Token Scope Escalation in API
- CVE-2026-56443Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
- CVE-2026-55987OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
- CVE-2026-55986Email Management API Bypasses ManageCredentials Feature Restrictions
- CVE-2026-55984Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
- CVE-2026-55982OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
- CVE-2026-54481Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
- CVE-2026-50105RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
- CVE-2026-42931Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
- CVE-2026-23603Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
- CVE-2026-34966Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass
- CVE-2026-58426Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
- CVE-2026-58424Permanent Fork PR Workflow Approval Gate Bypass
- CVE-2026-58423LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories