Gitea
by Go Gitea
Source repositories
CVEs (147)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-45326 | Hig | 0.57 | 8.8 | 0.01 | Feb 8, 2022 | Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests. | ||
| CVE-2018-18926 | Cri | 0.57 | 9.8 | 0.03 | Nov 4, 2018 | Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron. | ||
| CVE-2026-57894 | Hig | 0.55 | 8.5 | 0.00 | Aug 13, 2026 | Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration | ||
| CVE-2026-56443 | Cri | 0.55 | 9.6 | 0.01 | Aug 13, 2026 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | ||
| CVE-2026-58426 | Cri | 0.55 | 9.6 | 0.00 | Jul 3, 2026 | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write | ||
| CVE-2026-55987 | Hig | 0.53 | 8.1 | 0.00 | Aug 13, 2026 | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | ||
| CVE-2026-56750 | Cri | 0.52 | 9.1 | 0.00 | Aug 13, 2026 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session | ||
| CVE-2026-26247 | Cri | 0.52 | 9.1 | 0.01 | Jul 3, 2026 | Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check. | ||
| CVE-2026-26232 | Cri | 0.52 | 9.1 | 0.01 | Jul 3, 2026 | Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange. | ||
| CVE-2026-25718 | Cri | 0.52 | 9.1 | 0.01 | Jul 3, 2026 | Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths. | ||
| CVE-2026-22547 | Cri | 0.52 | 9.1 | 0.01 | Jul 3, 2026 | Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values. | ||
| CVE-2026-20706 | Cri | 0.52 | 9.1 | 0.01 | Jul 3, 2026 | Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint. | ||
| CVE-2026-20912 | Cri | 0.52 | 9.1 | 0.00 | Jan 22, 2026 | Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users. | ||
| CVE-2026-20897 | Cri | 0.52 | 9.1 | 0.00 | Jan 22, 2026 | Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories. | ||
| CVE-2026-20750 | Cri | 0.52 | 9.1 | 0.00 | Jan 22, 2026 | Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization. | ||
| CVE-2022-30781 | Hig | 0.52 | 7.5 | 0.88 | May 16, 2022 | Gitea before 1.16.7 does not escape git fetch remote. | ||
| CVE-2026-58424 | Hig | 0.51 | 8.9 | 0.00 | Jul 3, 2026 | Permanent Fork PR Workflow Approval Gate Bypass | ||
| CVE-2026-27775 | Hig | 0.50 | 8.8 | 0.01 | Jul 3, 2026 | Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access. | ||
| CVE-2020-14144 | Hig | 0.50 | 7.2 | 0.95 | Oct 16, 2020 | The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the… | ||
| CVE-2026-58438 | Hig | 0.49 | 7.5 | 0.00 | Aug 13, 2026 | Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access |
- risk 0.57cvss 8.8epss 0.01
Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
- risk 0.57cvss 9.8epss 0.03
Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.
- risk 0.55cvss 8.5epss 0.00
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
- risk 0.55cvss 9.6epss 0.01
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
- risk 0.55cvss 9.6epss 0.00
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
- risk 0.53cvss 8.1epss 0.00
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
- risk 0.52cvss 9.1epss 0.00
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
- risk 0.52cvss 9.1epss 0.01
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
- risk 0.52cvss 9.1epss 0.01
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.
- risk 0.52cvss 9.1epss 0.01
Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.
- risk 0.52cvss 9.1epss 0.01
Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.
- risk 0.52cvss 9.1epss 0.01
Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.
- risk 0.52cvss 9.1epss 0.00
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
- risk 0.52cvss 9.1epss 0.00
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
- risk 0.52cvss 9.1epss 0.00
Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.
- risk 0.52cvss 7.5epss 0.88
Gitea before 1.16.7 does not escape git fetch remote.
- risk 0.51cvss 8.9epss 0.00
Permanent Fork PR Workflow Approval Gate Bypass
- risk 0.50cvss 8.8epss 0.01
Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.
- risk 0.50cvss 7.2epss 0.95
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the…
- risk 0.49cvss 7.5epss 0.00
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Page 2 of 8