[ Vendor · 79 CVEs ]
Gitea
CVEs affecting Gitea published in the last 30 days, plus any Gitea CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-109844 | 18 Oct 2026 | CVSS 4.3 | Gitea`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it… | |
| CVE-2026-110311 | 18 Oct 2026 | CVSS 4.3 | GiteaCreating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that… | |
| CVE-2026-110324 | 18 Oct 2026 | CVSS 6.5 | GiteaThe visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a… | |
| CVE-2026-110494 | 18 Oct 2026 | CVSS 6.3 | GiteaAdding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A… | |
| CVE-2026-97204 | 18 Oct 2026 | CVSS 3.1 | GiteaDeleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences… | |
| CVE-2026-97859 | 18 Oct 2026 | CVSS 6.5 | GiteaSeven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were… | |
| CVE-2026-104627 | 18 Oct 2026 | CVSS 5.4 | GiteaThe Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had… | |
| CVE-2026-105661 | 18 Oct 2026 | CVSS 5.3 | GiteaRequesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil… | |
| CVE-2026-105964 | 18 Oct 2026 | CVSS 6.5 | GiteaThe Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and… | |
| CVE-2026-107618 | 18 Oct 2026 | Not scored yet | Gitea`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a… | |
| CVE-2026-107686 | 18 Oct 2026 | CVSS 4.3 | GiteaThe Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although… | |
| CVE-2026-109553 | 18 Oct 2026 | CVSS 7.5 | GiteaGitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea… | |
| CVE-2026-78231 | 14 Oct 2026 | CVSS 5.3 | GiteaWhen OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID… | |
| CVE-2026-78433 | 14 Oct 2026 | CVSS 5.9 | GiteaGitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions… | |
| CVE-2026-73800 | 14 Oct 2026 | CVSS 8.8 | GiteaGitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A… | |
| CVE-2026-73802 | 14 Oct 2026 | CVSS 8.8 | gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabledGitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace… | Fix |
| CVE-2026-73804 | 14 Oct 2026 | CVSS 8.1 | GiteaGitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with… | |
| CVE-2026-73814 | 14 Oct 2026 | CVSS 6.5 | GiteaGitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The… | |
| CVE-2026-73126 | 14 Oct 2026 | CVSS 4.3 | GiteaGitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the… | |
| CVE-2026-73130 | 14 Oct 2026 | CVSS 4.3 | GiteaGitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field… | |
| CVE-2026-73135 | 14 Oct 2026 | CVSS 5.3 | GiteaGitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose… | |
| CVE-2026-73273 | 14 Oct 2026 | CVSS 4.3 | GiteaGitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with… | |
| CVE-2026-73535 | 14 Oct 2026 | CVSS 8.8 | GiteaGitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and… | |
| CVE-2026-73539 | 14 Oct 2026 | CVSS 7.5 | GiteaGitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before… | |
| CVE-2026-68957 | 14 Oct 2026 | CVSS 4.3 | GiteaGitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A… | |
| CVE-2026-68964 | 14 Oct 2026 | CVSS 4.3 | GiteaGitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve… | |
| CVE-2026-70396 | 14 Oct 2026 | CVSS 5.4 | GiteaGitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other… | |
| CVE-2026-70400 | 14 Oct 2026 | CVSS 5.4 | GiteaGitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended… | |
| CVE-2026-70402 | 14 Oct 2026 | CVSS 5.8 | GiteaGitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask… | |
| CVE-2026-70406 | 14 Oct 2026 | CVSS 6.5 | GiteaGitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository… | |
| CVE-2026-70407 | 14 Oct 2026 | CVSS 4.3 | GiteaGitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can… | |
| CVE-2026-71184 | 14 Oct 2026 | CVSS 8.8 | GiteaGitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not… | |
| CVE-2026-71301 | 14 Oct 2026 | CVSS 4.3 | GiteaGitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member… | |
| CVE-2026-60018 | 14 Oct 2026 | CVSS 6.5 | GiteaGitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An… | |
| CVE-2026-60021 | 14 Oct 2026 | CVSS 6.5 | GiteaGitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context… | |
| CVE-2026-62925 | 14 Oct 2026 | CVSS 6.5 | GiteaGitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and… | |
| CVE-2026-63021 | 14 Oct 2026 | CVSS 6.5 | GiteaGitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them… | |
| CVE-2026-63792 | 14 Oct 2026 | CVSS 5.3 | GiteaGitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved… | |
| CVE-2026-66849 | 14 Oct 2026 | CVSS 4.3 | GiteaGitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts… | |
| CVE-2026-66853 | 14 Oct 2026 | CVSS 4.3 | GiteaGitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility… | |
| CVE-2026-66874 | 14 Oct 2026 | CVSS 6.5 | GiteaFor pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or… | |
| CVE-2026-66877 | 14 Oct 2026 | CVSS 8.1 | GiteaGitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval… | |
| CVE-2026-67577 | 14 Oct 2026 | CVSS 4.3 | GiteaGitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing… | |
| CVE-2026-59766 | 14 Oct 2026 | CVSS 4.3 | GiteaGitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the… | |
| CVE-2026-59774 | 14 Oct 2026 | CVSS 9.8 | GiteaGitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side… | |
| CVE-2026-60008 | 14 Oct 2026 | CVSS 3.5 | GiteaGitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and… | |
| CVE-2026-60010 | 14 Oct 2026 | CVSS 6.5 | GiteaGitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository… | |
| CVE-2026-25946 | 14 Oct 2026 | CVSS 5.3 | GiteaWhen OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against… | |
| CVE-2026-97626 | 6 Oct 2026 | CVSS 4.3 | GiteaRequesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header… | |
| CVE-2026-86684 | 6 Oct 2026 | CVSS 7.1 | GiteaThe Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with… | Fix |
| CVE-2026-89182 | 6 Oct 2026 | CVSS 5.4 | GiteaWith `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false`… | Fix |
| CVE-2026-96594 | 6 Oct 2026 | CVSS 6.1 | GiteaThe Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to… | Fix |
| CVE-2026-97208 | 6 Oct 2026 | CVSS 4.9 | GiteaThe Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and… | Fix |
| CVE-2026-105267 | 6 Oct 2026 | CVSS 8.1 | GiteaThe Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with… | Fix |
| CVE-2026-105268 | 6 Oct 2026 | CVSS 4.3 | GiteaThe Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that… | Fix |
| CVE-2026-104633 | 6 Oct 2026 | CVSS 6.5 | GiteaWhen migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated… | Fix |
| CVE-2026-101023 | 6 Oct 2026 | CVSS 9.1 | GiteaGitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a… | Fix |
| CVE-2026-96399 | 6 Oct 2026 | CVSS 7.5 | GiteaA repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea… | Fix |
| CVE-2026-96400 | 6 Oct 2026 | CVSS 4.3 | GiteaWith `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit… | Fix |
| CVE-2026-96404 | 6 Oct 2026 | CVSS 8.1 | GiteaWhen Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`… | Fix |
| CVE-2026-96580 | 6 Oct 2026 | CVSS 7.5 | GiteaGitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull… | Fix |
| CVE-2026-96589 | 6 Oct 2026 | CVSS 4.3 | GiteaWhen a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can… | Fix |
| CVE-2026-89430 | 6 Oct 2026 | CVSS 8.1 | GiteaGitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each… | Fix |
| CVE-2026-94205 | 6 Oct 2026 | CVSS 9.8 | GiteaGitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author… | Fix |
| CVE-2026-95106 | 6 Oct 2026 | CVSS 9.1 | GiteaGitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such… | Fix |
| CVE-2026-95112 | 6 Oct 2026 | CVSS 6.5 | GiteaWhen processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown… | Fix |
| CVE-2026-79960 | 6 Oct 2026 | CVSS 7.1 | GiteaWhen a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline… | Fix |
| CVE-2026-73278 | 6 Oct 2026 | CVSS 9.8 | GiteaGitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A… | Fix |
| CVE-2026-70357 | 6 Oct 2026 | CVSS 7.5 | GiteaGitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently… | Fix |
| CVE-2026-104626 | 6 Oct 2026 | CVSS 8.8 | GiteaA user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is… | Fix |
| CVE-2026-104632 | 6 Oct 2026 | CVSS 8.8 | GiteaGitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path… | Fix |
| CVE-2026-104636 | 6 Oct 2026 | CVSS 7.5 | GiteaGitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git… | Fix |
| CVE-2026-103059 | 6 Oct 2026 | CVSS 9.1 | GiteaWhen Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its… | Fix |
| CVE-2026-103504 | 6 Oct 2026 | CVSS 8.1 | GiteaChanging an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the… | |
| CVE-2026-103667 | 6 Oct 2026 | CVSS 5.4 | GiteaGitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a… | Fix |
| CVE-2026-103670 | 6 Oct 2026 | CVSS 7.5 | GiteaWhen a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run… | Fix |
| CVE-2026-101027 | 6 Oct 2026 | CVSS 7.7 | GiteaWhen `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address against the… | Fix |
| CVE-2026-101029 | 6 Oct 2026 | CVSS 4.3 | GiteaGitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address… | Fix |
| CVE-2026-60004 | 26 Aug 2026 | CVSS 9.8 | Gitea Code InjectionGitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. | Exploited |