Security Advisories for code.gitea.io/gitea in go
High
18 days ago
Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
go
code.gitea.io/gitea
Low
18 days ago
Gitea: Webhook Authorization Header Returned in Plaintext via API
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
go
code.gitea.io/gitea
High
18 days ago
Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
go
code.gitea.io/gitea
High
18 days ago
Gitea: Notification API leaks private issue metadata after access revocation
go
code.gitea.io/gitea
High
18 days ago
Gitea: Unauthorized Access to Labels of Private Organizations
go
code.gitea.io/gitea
High
18 days ago
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
go
code.gitea.io/gitea
High
18 days ago
Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private
go
code.gitea.io/gitea
High
18 days ago
Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
go
code.gitea.io/gitea
High
18 days ago
Gitea: Repository Visibility Manipulation via Git Push Options
go
code.gitea.io/gitea
High
18 days ago
Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
go
code.gitea.io/gitea
Low
18 days ago
Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
go
code.gitea.io/gitea
Low
18 days ago
Gitea: Private Repository Metadata Remains Accessible After Access Revocation
go
code.gitea.io/gitea
High
18 days ago
Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
go
code.gitea.io/gitea
Low
18 days ago
Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
go
code.gitea.io/gitea
Critical
18 days ago
Gitea: Public-only repository tokens can update private PR head branches
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
go
code.gitea.io/gitea
Critical
18 days ago
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
go
code.gitea.io/gitea
High
18 days ago
Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
go
code.gitea.io/gitea
High
18 days ago
Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
go
code.gitea.io/gitea
Critical
18 days ago
Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
go
code.gitea.io/gitea
Critical
18 days ago
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions
go
code.gitea.io/gitea
High
18 days ago
Gitea: Privilege Escalation via Access Token Scope Escalation in API
go
code.gitea.io/gitea
High
18 days ago
Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content
go
code.gitea.io/gitea
Low
18 days ago
Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
go
code.gitea.io/gitea
Critical
18 days ago
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: draft release attachment disclosure via missing web authorization
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
go
code.gitea.io/gitea
High
18 days ago
Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
go
code.gitea.io/gitea
Moderate
18 days ago
Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`
go
code.gitea.io/gitea
High
18 days ago
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
go
code.gitea.io/gitea
High
22 days ago
Gitea has insufficient permission checks for Composer package source links
go
code.gitea.io/gitea
High
about 2 months ago
Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
go
code.gitea.io/gitea
High
about 2 months ago
Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
go
code.gitea.io/gitea
High
about 2 months ago
Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
go
code.gitea.io/gitea
Moderate
about 2 months ago
Gitea: Token scope bypass on web archive download endpoint
go
code.gitea.io/gitea
Moderate
about 2 months ago
Gitea: Missing repository-unit authorization on issue-template API endpoints
go
code.gitea.io/gitea
Moderate
about 2 months ago
Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw
go
code.gitea.io/gitea
High
about 2 months ago
Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
go
code.gitea.io/gitea
High
about 2 months ago
Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication
go
code.gitea.io/gitea
High
about 2 months ago
Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
go
code.gitea.io/gitea
Low
7 months ago
Gitea may send release notification emails for private repositories to users whose access has been revoked
go
code.gitea.io/gitea
Moderate
7 months ago
Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists
go
code.gitea.io/gitea
Moderate
8 months ago
Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order
go
code.gitea.io/gitea
Moderate
8 months ago
Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries
go
code.gitea.io/gitea
Moderate
8 months ago
Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text
go
code.gitea.io/gitea
Moderate
8 months ago
Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources
go
code.gitea.io/gitea
Moderate
8 months ago
Gitea mishandles authorization for deletion of releases
go
code.gitea.io/gitea
High
8 months ago
Gitea allows attackers to add attachments with forbidden file extensions
go
code.gitea.io/gitea
Low
8 months ago
Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.
go
code.gitea.io/gitea
Likely fork
Likely fork
Likely fork
Likely fork
Likely fork
Likely fork
Likely fork
Likely fork