code.gitea.io/gitea vulnerabilities
123 known advisories · Dependencies not checked · showing first 100
SEVERITYADVISORYPUBLISHED
HighGitea allows attackers to add attachments with forbidden file extensionsOSV source ↗11 months ago
HighGitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval FlagOSV source ↗4 months ago
UnknownGitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.devOSV source ↗2 months ago
CriticalGitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`OSV source ↗4 months ago
CriticalGitea pre-receive hook scanner errors allow branch-protection bypassOSV source ↗4 months ago
CriticalGitea LFS mirror operations bypass migration HTTP transport protectionsOSV source ↗4 months ago
CriticalGitea: Public-only repository tokens can update private PR head branchesOSV source ↗4 months ago
CriticalGitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state writeOSV source ↗4 months ago
CriticalGitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default FilterOSV source ↗4 months ago
CriticalGitea template repository generation follows unsafe filesystem pathsOSV source ↗2 months ago
HighGitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository WriteOSV source ↗4 months ago
HighGitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository ExfiltrationOSV source ↗4 months ago
HighGitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repoOSV source ↗5 months ago
HighGitea has insufficient permission checks for Composer package source linksOSV source ↗4 months ago
HighGitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)OSV source ↗4 months ago
HighGitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routesOSV source ↗5 months ago
HighGitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret ExfiltrationOSV source ↗5 months ago
HighGitea: OAuth2 access token scope enforcement bypass via HTTP Basic authenticationOSV source ↗5 months ago
HighGitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accountsOSV source ↗4 months ago
HighGitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsOSV source ↗4 months ago
HighGitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package UploadOSV source ↗4 months ago
HighGitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositoriesOSV source ↗4 months ago
HighGitea organization permission APIs expose hidden membership and private organization dataOSV source ↗2 months ago
HighGitea pull request branch permission checks allow unauthorized updates and rebasesOSV source ↗2 months ago
HighGitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud MetadataOSV source ↗4 months ago
HighGitea: Notification API leaks private issue metadata after access revocationOSV source ↗4 months ago
HighGitea: Fork Synchronization Continues After Parent Repository Changes from Public to PrivateOSV source ↗4 months ago
HighGitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config overrideOSV source ↗4 months ago
HighGitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of serviceOSV source ↗4 months ago
HighGitea draft releases and attachments are exposed without write permissionOSV source ↗4 months ago
HighGitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surfaceOSV source ↗4 months ago
MediumGitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIsOSV source ↗4 months ago
MediumGitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag EndpointOSV source ↗4 months ago
MediumGitea: Repository migration SSRF via multi-answer DNS allow-list bypassOSV source ↗4 months ago
MediumGitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)OSV source ↗4 months ago
MediumGitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURLOSV source ↗4 months ago
MediumGitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token ScopesOSV source ↗4 months ago
MediumGitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation RestrictionsOSV source ↗4 months ago
MediumGitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploadsOSV source ↗4 months ago
MediumGitea: Cross-repository issue/comment attachment re-linking can expose private attachment contentOSV source ↗4 months ago
MediumGitea: draft release attachment disclosure via missing web authorizationOSV source ↗4 months ago
MediumGitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-textOSV source ↗11 months ago
MediumGitea: Private Repository Existence Disclosure via go-get Meta EndpointOSV source ↗4 months ago
MediumGitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username existsOSV source ↗10 months ago
MediumGitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort orderOSV source ↗11 months ago
MediumGitea sometimes mishandles propagation of token scope for access control within one of its own package registriesOSV source ↗11 months ago
MediumGitea: Public-Only Personal access tokens scope bypass in Organization and Permission EndpointsOSV source ↗4 months ago
MediumGitea mishandles access to a private resource upon receiving an API token with scope limited to public resourcesOSV source ↗11 months ago
MediumGitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->privateOSV source ↗4 months ago
MediumGitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)OSV source ↗4 months ago
MediumGitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contentsOSV source ↗4 months ago
MediumGitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit dataOSV source ↗4 months ago
MediumGitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)OSV source ↗4 months ago
MediumGitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118OSV source ↗4 months ago
MediumGitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`OSV source ↗4 months ago