Go Gitea: 25 Vulnerabilities Disclosed in Single Batch, Affecting Access Control and Workflows
Go Gitea faces a critical disclosure of 25 vulnerabilities, including privilege escalation and access control bypasses, impacting its security and workflow integrity.
Key findings
- 25 vulnerabilities disclosed simultaneously for Go Gitea on October 14, 2026.
- High-severity flaws include privilege escalation and workflow bypasses.
- Multiple vulnerabilities stem from improper access control and permission checks.
- Issues affect authentication, repository management, and CI/CD workflows.
- Users are urged to update Gitea to address these widespread security concerns.
On October 14, 2026, a significant batch of 25 vulnerabilities was disclosed for Go Gitea, the self-hosted Git service. These vulnerabilities, all disclosed on the same day, span a range of severity levels, including two rated as High, and expose various aspects of the platform to potential attackers. The disclosures highlight issues related to authentication, authorization, repository access control, and workflow execution, underscoring the need for immediate attention from Gitea administrators.
Several vulnerabilities revolve around improper permission checks and access control bypasses. CVE-2026-78433, for instance, allows unauthenticated attackers to access private attachments by exploiting a skipped ownership check in the web attachment handler. Similarly, CVE-2026-73804 enables an attacker with a write:user scope token to register an SSH public key on the token owner's account, leading to authentication bypasses. CVE-2026-73814 permits an authenticated collaborator with Admin access to escalate their privileges to Owner, enabling repository transfer.
Another group of vulnerabilities impacts Gitea's handling of sensitive information and repository visibility. CVE-2026-73135 reveals that some repository-listing endpoints incorrectly expose repository metadata for private repositories to unauthorized viewers. CVE-2026-70407 shows that the organization-list API can leak metadata for private organizations, even when accessed with a restricted token. Furthermore, CVE-2026-68964 and CVE-2026-68957 detail how restricted accounts can retrieve sensitive information like SSH/GPG keys and issue details from users with limited visibility settings.
Concerns regarding workflow security are also prominent. CVE-2026-73800 allows a fork author to execute attacker-controlled code with repository and organization secrets by manipulating reusable workflows during pull_request_target events. CVE-2026-73802 demonstrates that Gitea Runner can pass workflow-controlled container options into Docker job containers, potentially allowing host namespace escapes even when privileged mode is disabled. CVE-2026-66877 describes a bypass of the first-time fork contributor approval mechanism, enabling unapproved jobs to run.
The batch also includes vulnerabilities related to input validation and resource management. CVE-2026-73539 points to a shell argument injection vulnerability in the repository markup endpoint due to improper escaping of context fields. CVE-2026-73130 highlights an issue where the gitignores field in repository creation forms and APIs is not length-limited, potentially leading to denial-of-service conditions. CVE-2026-73273 involves an oversized Maven upload that bypasses package-size quotas.
Finally, several vulnerabilities touch upon authentication mechanisms and API security. CVE-2026-78231 and CVE-2026-73535 describe flaws in the OpenID sign-in process, allowing attackers to interact with internal services or link attacker-controlled identifiers without proper verification. CVE-2026-70406 allows a public-only token to access commit history and diffs from private repositories by routing requests through a public base repository. CVE-2026-70402 indicates that Git hook directories can be created with insecure permissions (0777), allowing local users to modify hooks if the umask is permissive.
Administrators are urged to review the specific CVEs affecting their Gitea instances and apply the necessary patches. The comprehensive nature of this disclosure indicates a broad need for security diligence across the platform's various features.
The vulnerabilities disclosed include: CVE-2026-78433, CVE-2026-78231, CVE-2026-73814, CVE-2026-73804, CVE-2026-73802, CVE-2026-73800, CVE-2026-73539, CVE-2026-73535, CVE-2026-73273, CVE-2026-73135, CVE-2026-73130, CVE-2026-73126, CVE-2026-71301, CVE-2026-71184, CVE-2026-70407, CVE-2026-70406, CVE-2026-70402, CVE-2026-70400, CVE-2026-70396, CVE-2026-68964, CVE-2026-68957, CVE-2026-67577, CVE-2026-66877, CVE-2026-66874, CVE-2026-66853.