Gitea
by Go Gitea
Source repositories
CVEs (146)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-20779 | Hig | 0.39 | 7.1 | 0.00 | Jul 3, 2026 | Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path. | ||
| CVE-2022-0905 | Hig | 0.39 | 7.1 | 0.01 | Mar 10, 2022 | Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. | ||
| CVE-2026-58440 | Med | 0.37 | 6.8 | 0.00 | Aug 13, 2026 | Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`) | ||
| CVE-2022-1058 | Med | 0.37 | 6.1 | 0.53 | Mar 24, 2022 | Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. | ||
| CVE-2026-58435 | Med | 0.35 | 5.4 | 0.00 | Aug 13, 2026 | Gitea LFS Deploy-Key Privilege Escalation | ||
| CVE-2026-58428 | Med | 0.35 | 6.5 | 0.00 | Aug 13, 2026 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | ||
| CVE-2026-57897 | Med | 0.35 | 6.5 | 0.00 | Aug 13, 2026 | Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs | ||
| CVE-2026-24059 | Med | 0.35 | 6.5 | 0.00 | Aug 13, 2026 | The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked… | ||
| CVE-2026-58418 | Med | 0.35 | 6.5 | 0.00 | Jul 3, 2026 | SSRF via HTTP Redirect in Repository Migration | ||
| CVE-2026-20904 | Med | 0.35 | 6.5 | 0.00 | Jan 22, 2026 | Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities. | ||
| CVE-2026-20883 | Med | 0.35 | 6.5 | 0.00 | Jan 22, 2026 | Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches. | ||
| CVE-2026-20800 | Med | 0.35 | 6.5 | 0.00 | Jan 22, 2026 | Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications. | ||
| CVE-2022-38795 | Med | 0.35 | 6.5 | 0.01 | Aug 7, 2023 | In Gitea through 1.17.1, repo cloning can occur in the migration function. | ||
| CVE-2022-38183 | Med | 0.35 | 6.5 | 0.01 | Aug 12, 2022 | In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to… | ||
| CVE-2026-56755 | Med | 0.33 | 6.2 | 0.00 | Aug 13, 2026 | Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload | ||
| CVE-2019-1010314 | Med | 0.33 | 6.1 | 0.01 | Jul 11, 2019 | Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page. | ||
| CVE-2026-58432 | Med | 0.31 | 5.9 | 0.00 | Aug 13, 2026 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea | ||
| CVE-2026-57886 | Med | 0.31 | 5.9 | 0.00 | Aug 13, 2026 | Cross-repository issue/comment attachment re-linking can expose private attachment content | ||
| CVE-2025-68945 | Med | 0.31 | 5.8 | 0.00 | Dec 26, 2025 | In Gitea before 1.21.2, an anonymous user can visit a private user's project. | ||
| CVE-2026-58420 | Med | 0.29 | 4.4 | 0.00 | Aug 13, 2026 | Local File Inclusion via file:// URI in Migration Restore |
- risk 0.39cvss 7.1epss 0.00
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.
- risk 0.39cvss 7.1epss 0.01
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.
- risk 0.37cvss 6.8epss 0.00
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
- risk 0.37cvss 6.1epss 0.53
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.
- risk 0.35cvss 5.4epss 0.00
Gitea LFS Deploy-Key Privilege Escalation
- risk 0.35cvss 6.5epss 0.00
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
- risk 0.35cvss 6.5epss 0.00
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
- risk 0.35cvss 6.5epss 0.00
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked…
- risk 0.35cvss 6.5epss 0.00
SSRF via HTTP Redirect in Repository Migration
- risk 0.35cvss 6.5epss 0.00
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.
- risk 0.35cvss 6.5epss 0.00
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.
- risk 0.35cvss 6.5epss 0.00
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
- risk 0.35cvss 6.5epss 0.01
In Gitea through 1.17.1, repo cloning can occur in the migration function.
- risk 0.35cvss 6.5epss 0.01
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to…
- risk 0.33cvss 6.2epss 0.00
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
- risk 0.33cvss 6.1epss 0.01
Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.
- risk 0.31cvss 5.9epss 0.00
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
- risk 0.31cvss 5.9epss 0.00
Cross-repository issue/comment attachment re-linking can expose private attachment content
- risk 0.31cvss 5.8epss 0.00
In Gitea before 1.21.2, an anonymous user can visit a private user's project.
- risk 0.29cvss 4.4epss 0.00
Local File Inclusion via file:// URI in Migration Restore
Page 4 of 8