.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

code.gitea.io/gitea vulnerabilities

123 known advisories · Dependencies not checked · showing 23 more

SEVERITYADVISORYPUBLISHED

MediumGitea mishandles authorization for deletion of releasesGHSA-cm54-pfmc-xrwxBIT-gitea-2025-68938CVE-2025-68938GO-2025-4258Affected <1.25.2Fixed in 1.25.2OSV source ↗11 months ago

LowGitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claimGHSA-x77v-q46j-393gCVE-2026-23603GO-2026-6083Affected <1.27.0Fixed in 1.27.0OSV source ↗4 months ago

LowGitea doesn't adequately enforce branch deletion permissions after merging a pull request.GHSA-rrcw-5rjv-vj26BIT-gitea-2025-68940CVE-2025-68940GO-2025-4267Affected <1.22.5Fixed in 1.22.5OSV source ↗11 months ago

LowGitea: Private Repository Metadata Remains Accessible After Access RevocationGHSA-j2w3-9c3r-g83qCVE-2026-58434GO-2026-6062Affected <1.27.0Fixed in 1.27.0OSV source ↗4 months ago

LowGitea may send release notification emails for private repositories to users whose access has been revokedGHSA-8fwc-qjw5-rvgpBIT-gitea-2026-0798CVE-2026-0798GHSA-f4wq-6ww5-m56pGO-2026-4365Affected <1.25.4Fixed in 1.25.4OSV source ↗9 months ago

LowGitea has improper access control for uploaded attachmentsGHSA-hgr3-x44x-33hxBIT-gitea-2026-20736CVE-2026-20736GHSA-jr6h-pwwp-c8g6GO-2026-4367Affected <1.25.4Fixed in 1.25.4OSV source ↗9 months ago

Lowcode.gitea.io/gitea Open Redirect vulnerabilityGHSA-cf6v-9j57-v6r6BIT-gitea-2023-3515CVE-2023-3515GO-2023-1894Affected <1.19.4Fixed in 1.19.4OSV source ↗3 years ago

LowGitea: Webhook Authorization Header Returned in Plaintext via APIGHSA-3r5c-2xxx-h872CVE-2026-58511GO-2026-6040Affected <1.27.0Fixed in 1.27.0OSV source ↗4 months ago

LowGitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of ServiceGHSA-m932-crvm-gcp5CVE-2026-55984GO-2026-6064Affected <1.27.0Fixed in 1.27.0OSV source ↗4 months ago

LowGitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APIGHSA-pgqf-926r-548mCVE-2026-58445GO-2026-6067Affected <1.27.0Fixed in 1.27.0OSV source ↗4 months ago

UnknownGitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/giteaGO-2026-6029CVE-2026-28740GHSA-2m9v-5q2g-58vqAffected <1.26.3Fixed in 1.26.3OSV source ↗4 months ago

UnknownGitea: Open Redirect via redirect_to in code.gitea.io/giteaGO-2026-5448CVE-2026-25779GHSA-j5r2-4c8j-xc3mAffected <1.26.0Fixed in 1.26.0OSV source ↗5 months ago

UnknownGitea improperly exposes issue and pull request titles in code.gitea.io/giteaGO-2026-4362BIT-gitea-2026-20800CVE-2026-20800GHSA-2vgv-hgv4-22mhGHSA-g54m-9f6g-wj7qAffected <1.25.4Fixed in 1.25.4OSV source ↗9 months ago

UnknownGitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/giteaGO-2026-4363BIT-gitea-2026-20897CVE-2026-20897GHSA-393c-qgvj-3xphGHSA-rrq5-r9h5-pc7cAffected <1.25.4Fixed in 1.25.4OSV source ↗9 months ago

UnknownGitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/giteaGO-2026-4364BIT-gitea-2026-20912CVE-2026-20912GHSA-4xx9-vc8v-87hvGHSA-vfmv-f93v-37mwAffected <1.25.4Fixed in 1.25.4OSV source ↗9 months ago

UnknownGitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/giteaGO-2026-4366BIT-gitea-2026-20888CVE-2026-20888GHSA-9cgq-wp42-4rpqGHSA-ccq9-c5hv-cf64Affected <1.25.4Fixed in 1.25.4OSV source ↗9 months ago

UnknownGitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/giteaGO-2026-4368BIT-gitea-2026-20883CVE-2026-20883GHSA-644v-xv3j-xgqgGHSA-j8xr-c56q-m8jjAffected <1.25.4Fixed in 1.25.4OSV source ↗9 months ago

UnknownGitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/giteaGO-2026-4369BIT-gitea-2026-20904CVE-2026-20904GHSA-jrpc-w85r-hgqxGHSA-qqgv-v353-cv8pAffected <1.25.4Fixed in 1.25.4OSV source ↗9 months ago

UnknownGitea does not properly validate project ownership in organization project operations in code.gitea.io/giteaGO-2026-4370BIT-gitea-2026-20750CVE-2026-20750GHSA-h4fh-pc4w-8w27GHSA-rw22-5hhq-pfpfAffected <1.25.4Fixed in 1.25.4OSV source ↗9 months ago

UnknownGitea vulnerable to Argument Injection in code.gitea.io/giteaGO-2022-1065BIT-gitea-2022-42968CVE-2022-42968GHSA-w8xw-7crf-h23xAffected <1.17.3Fixed in 1.17.3OSV source ↗2 years ago

UnknownDenial of Service in Gitea in code.gitea.io/giteaGO-2022-0830BIT-gitea-2020-13246CVE-2020-13246GHSA-g2qx-6ghw-67hmAffected <1.12.0Fixed in 1.12.0OSV source ↗2 years ago

UnknownCapture-replay in Gitea in code.gitea.io/giteaGO-2022-0310BIT-gitea-2021-45327CVE-2021-45327GHSA-jrpg-35hw-m4p9Affected <1.11.2Fixed in 1.11.2OSV source ↗2 years ago

UnknownBuffer Overflow in gitea in code.gitea.io/giteaGO-2024-2757BIT-gitea-2021-3382CVE-2021-3382GHSA-9f8c-pfvv-p4gmAffected >=1.9.0 <1.13.2Fixed in 1.13.2OSV source ↗2 years ago