Go Gitea: Twelve Vulnerabilities Disclosed Together Affecting API and User Data Access
Go Gitea patched twelve vulnerabilities on October 18, 2026, affecting API access, data visibility, and service stability.
Key findings
- Twelve Gitea vulnerabilities disclosed on October 18, 2026, impacting API access and data visibility.
- Issues include improper user visibility enforcement, exposure of private profile details, and unauthorized access to repository subscriptions.
- Vulnerabilities also affect release attachment handling, label management, and reaction controls on issues.
- Denial-of-service risks identified through oversized artifact requests and panic conditions.
- All twelve CVEs are addressed in Gitea version 1.20.4.
On October 18, 2026, Go Gitea disclosed twelve vulnerabilities affecting its self-hosted Git service. The disclosures cluster around API and user data access controls, with several issues stemming from insufficient permission checks in various routes and functionalities. These vulnerabilities could allow authenticated users to access private information, modify repository settings, or disrupt service availability.
Several vulnerabilities revolve around improper handling of user and repository visibility. CVE-2026-97859 highlights that seven API routes under /api/v1/users/{username} lacked the necessary middleware to enforce user visibility, potentially exposing followers, following lists, and starred repositories. Similarly, CVE-2026-110324 indicates that Gitea's user profile visibility checks were not consistently applied to all requests, allowing authenticated users to retrieve private profile details like full name and location. Furthermore, CVE-2026-109844 reveals that the user subscriptions API (GET /api/v1/user/subscriptions) could return metadata for private repositories even after a user lost access, breaching confidentiality.
Other issues impact repository and release management. CVE-2026-97204 describes a flaw where deleting labels could inadvertently delete organization labels if repository and organization IDs overlapped, affecting label management for entire organizations. CVE-2026-110494 and CVE-2026-110311 both relate to release attachments; the former allowed users to link existing attachments to releases without proper checks, potentially exposing file details, while the latter exposed metadata for unlinked attachments when creating draft releases.
Security controls for interactions and authentication were also found wanting. CVE-2026-107686 points out that reactions on issues and comments could be added or removed by users without write access on locked issues, bypassing intended restrictions. CVE-2026-107618 describes a cross-site scripting vulnerability where the POST /{owner}/{repo}/topics endpoint lacked cross-origin protection, allowing a malicious website to alter repository topics if an administrator visited it. On the authentication front, CVE-2026-104627 details how the OpenID association callback could be exploited by an attacker-controlled OpenID provider to link their identity to a victim's account without proper user initiation.
The batch also includes vulnerabilities related to SSH key handling and denial-of-service. CVE-2026-109553 involves Gitea's SSH certificate principal resolution, which could be exploited if specific configurations were met, potentially allowing unauthorized access. CVE-2026-105964 describes a denial-of-service vulnerability in the Actions artifact service, where oversized requests could exhaust server memory and terminate the Gitea process. Finally, CVE-2026-105661 details a panic condition triggered by requesting repositories for an individual user under certain circumstances, leading to HTTP 500 errors.
All twelve vulnerabilities were addressed in Gitea version 1.20.4. Users are strongly advised to update to the latest version to mitigate these security risks. The consistent disclosure of these issues on a single date suggests a coordinated release by the Go Gitea security team, highlighting the importance of timely patching for self-hosted services.
The Go Gitea team has released version 1.20.4, which includes fixes for all twelve disclosed vulnerabilities. Users are urged to update their instances immediately to prevent potential exploitation. The vulnerabilities span various aspects of the platform, including API access control, data visibility, repository management, and denial-of-service vectors.
The disclosure of these twelve CVEs on October 18, 2026, underscores the ongoing need for vigilance in maintaining the security of self-hosted development platforms. Users should ensure they are running the latest patched version of Gitea.
Key findings from this batch include:
- Inconsistent visibility checks across multiple API routes and user profile endpoints.
- Flaws in release attachment handling could expose sensitive file metadata.
- Weaknesses in reaction handling on issues and cross-origin protection for repository topics.
- Potential for denial-of-service via oversized artifact requests and panic conditions.
- SSH certificate validation issues and OpenID assertion vulnerabilities.
- All twelve vulnerabilities were patched in Gitea version 1.20.4.