Gitea vulnerabilities
210 CVEs and advisories name Gitea as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-58422Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
- CVE-2026-58421Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
- CVE-2026-58419Notification API leaks private issue metadata after access revocation
- CVE-2026-58418SSRF via HTTP Redirect in Repository Migration
- CVE-2026-28744Gitea Git smart HTTP bypasses repository token scopes for bearer tokens
- CVE-2026-28740Gitea LFS object reuse bypasses Code-unit authorization
- CVE-2026-28737Gitea 3D file viewer allows stored XSS through glTF extensionsRequired
- CVE-2026-28705Gitea repository dumps write release assets using unsafe path names
- CVE-2026-28699Gitea Basic Auth bypasses OAuth2 access token scopes
- CVE-2026-27783Gitea issue-template APIs bypass repository unit authorization
- CVE-2026-27780Gitea pre-receive hook can miss branch-protection checks after scanner errors
- CVE-2026-27779Gitea forwarded-proto handling allows public URL spoofing
- CVE-2026-27775Gitea pre-receive hook permission cache allows full repository write access
- CVE-2026-27771Gitea Composer package source links use insufficient permission checks
- CVE-2026-27761Gitea repository feeds bypass API token scope enforcement
- CVE-2026-27660Gitea draft releases use insufficient permission checks
- CVE-2026-27657Gitea email settings allow changing another user's primary email address
- CVE-2026-26307Gitea git grep search lacks a timeout
- CVE-2026-26292Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
- CVE-2026-26247Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
- CVE-2026-26232Gitea OAuth2 authorization codes lack expiry and reuse enforcement
- CVE-2026-26231Gitea maintainer-edit permissions allow unauthorized commits to readable repositories
- CVE-2026-25782Gitea tracked-time deletion can target entries from another issue
- CVE-2026-25779Gitea redirect handling permits open redirects through backslash paths
- CVE-2026-25718Gitea template repository generation mishandles symlinked paths
- CVE-2026-25714Gitea user organization API bypasses public-only token filtering
- CVE-2026-25712Gitea organization permission APIs expose private visibility information
- CVE-2026-25038Gitea private organization labels are visible to unauthorized users
- CVE-2026-24690Gitea pull-request branch updates use insufficient permission checks
- CVE-2026-24451Gitea fork synchronization can expose private parent repository data