Gitea
by Go Gitea
Source repositories
CVEs (224)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-97208 | Med | 0.25 | 4.9 | 0.00 | Oct 6, 2026 | The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new… | ||
| CVE-2026-58429 | Med | 0.25 | 4.9 | 0.00 | Aug 13, 2026 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | ||
| CVE-2025-68941 | Med | 0.25 | 4.9 | 0.00 | Dec 26, 2025 | Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources. | ||
| CVE-2021-28378 | Low | 0.25 | 3.7 | 0.09 | Mar 15, 2021 | Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations. | ||
| CVE-2026-52807 | Med | 0.24 | — | 0.00 | Jun 24, 2026 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go's default auto-escaping ({{.Name}}), which converts < to < etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text… | ||
| CVE-2023-3515 | Med | 0.22 | 4.4 | 0.00 | Jul 5, 2023 | Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. | ||
| CVE-2026-110311 | Med | 0.21 | 4.3 | 0.00 | Oct 18, 2026 | Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name,… | ||
| CVE-2026-109844 | Med | 0.21 | 4.3 | 0.00 | Oct 18, 2026 | `GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade,… | ||
| CVE-2026-107686 | Med | 0.21 | 4.3 | 0.00 | Oct 18, 2026 | The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments,… | ||
| CVE-2026-73273 | Med | 0.21 | 4.3 | 0.00 | Oct 14, 2026 | Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most… | ||
| CVE-2026-73130 | Med | 0.21 | 4.3 | 0.00 | Oct 14, 2026 | Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create… | ||
| CVE-2026-73126 | Med | 0.21 | 4.3 | 0.00 | Oct 14, 2026 | Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a… | ||
| CVE-2026-71301 | Med | 0.21 | 4.3 | 0.00 | Oct 14, 2026 | Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a private repository can submit a markup preview request and retrieve a private pull request's title and… | ||
| CVE-2026-70407 | Med | 0.21 | 4.3 | 0.00 | Oct 14, 2026 | Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private… | ||
| CVE-2026-68964 | Med | 0.21 | 4.3 | 0.00 | Oct 14, 2026 | Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure… | ||
| CVE-2026-68957 | Med | 0.21 | 4.3 | 0.00 | Oct 14, 2026 | Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword… | ||
| CVE-2026-67577 | Med | 0.21 | 4.3 | 0.00 | Oct 14, 2026 | Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny.… | ||
| CVE-2026-66853 | Med | 0.21 | 4.3 | 0.00 | Oct 14, 2026 | Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships… | ||
| CVE-2026-66849 | Med | 0.21 | 4.3 | 0.00 | Oct 14, 2026 | Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The… | ||
| CVE-2026-59766 | Med | 0.21 | 4.3 | 0.00 | Oct 14, 2026 | Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through… |
- risk 0.25cvss 4.9epss 0.00
The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new…
- risk 0.25cvss 4.9epss 0.00
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
- risk 0.25cvss 4.9epss 0.00
Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.
- risk 0.25cvss 3.7epss 0.09
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.
- risk 0.24cvss —epss 0.00
Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go's default auto-escaping ({{.Name}}), which converts < to < etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text…
- risk 0.22cvss 4.4epss 0.00
Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.
- risk 0.21cvss 4.3epss 0.00
Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name,…
- risk 0.21cvss 4.3epss 0.00
`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade,…
- risk 0.21cvss 4.3epss 0.00
The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments,…
- risk 0.21cvss 4.3epss 0.00
Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most…
- risk 0.21cvss 4.3epss 0.00
Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create…
- risk 0.21cvss 4.3epss 0.00
Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a…
- risk 0.21cvss 4.3epss 0.00
Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a private repository can submit a markup preview request and retrieve a private pull request's title and…
- risk 0.21cvss 4.3epss 0.00
Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private…
- risk 0.21cvss 4.3epss 0.00
Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure…
- risk 0.21cvss 4.3epss 0.00
Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword…
- risk 0.21cvss 4.3epss 0.00
Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny.…
- risk 0.21cvss 4.3epss 0.00
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships…
- risk 0.21cvss 4.3epss 0.00
Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The…
- risk 0.21cvss 4.3epss 0.00
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through…
Page 10 of 12