Gitea
by Go Gitea
Source repositories
CVEs (146)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-27783 | Med | 0.21 | 4.3 | 0.00 | Jul 3, 2026 | Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints. | ||
| CVE-2026-27761 | Med | 0.21 | 4.3 | 0.00 | Jul 3, 2026 | Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope. | ||
| CVE-2026-25714 | Med | 0.21 | 4.3 | 0.00 | Jul 3, 2026 | Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941. | ||
| CVE-2026-20888 | Med | 0.21 | 4.3 | 0.00 | Jan 22, 2026 | Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users. | ||
| CVE-2025-68938 | Med | 0.21 | 4.3 | 0.00 | Dec 26, 2025 | Gitea before 1.25.2 mishandles authorization for deletion of releases. | ||
| CVE-2022-46685 | Med | 0.21 | 4.3 | 0.00 | Dec 12, 2022 | In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log. | ||
| CVE-2026-58511 | Low | 0.18 | 2.7 | 0.00 | Aug 13, 2026 | Webhook Authorization Header Returned in Plaintext via API | ||
| CVE-2026-58445 | Low | 0.18 | 2.7 | 0.00 | Aug 13, 2026 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | ||
| CVE-2026-55984 | Low | 0.18 | 2.7 | 0.00 | Aug 13, 2026 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | ||
| CVE-2026-0798 | Low | 0.16 | 3.5 | 0.00 | Jan 22, 2026 | Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing… | ||
| CVE-2026-23603 | Low | 0.13 | 3.1 | 0.00 | Aug 13, 2026 | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim | ||
| CVE-2025-68940 | Low | 0.13 | 3.1 | 0.00 | Dec 26, 2025 | In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request. | ||
| CVE-2019-11229 | Hig | 0.07 | 8.8 | 0.55 | Apr 15, 2019 | models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution. | ||
| CVE-2026-27771 | Hig | 0.03 | 8.2 | 0.43 | Jul 3, 2026 | Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. | ||
| CVE-2021-28378 | Low | 0.01 | 3.7 | 0.09 | Mar 15, 2021 | Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations. | ||
| CVE-2026-28705 | Med | 0.00 | 5.3 | 0.00 | Jul 3, 2026 | Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths. | ||
| CVE-2026-27780 | Cri | 0.00 | 9.8 | 0.00 | Jul 3, 2026 | Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks. | ||
| CVE-2026-27779 | Hig | 0.00 | 7.5 | 0.00 | Jul 3, 2026 | Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation. | ||
| CVE-2026-27660 | Hig | 0.00 | 7.5 | 0.00 | Jul 3, 2026 | Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission. | ||
| CVE-2026-27657 | Hig | 0.00 | 7.5 | 0.00 | Jul 3, 2026 | Gitea versions before 1.25.5 allow a user to change another user's primary email address. |
- risk 0.21cvss 4.3epss 0.00
Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.
- risk 0.21cvss 4.3epss 0.00
Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.
- risk 0.21cvss 4.3epss 0.00
Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.
- risk 0.21cvss 4.3epss 0.00
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users.
- risk 0.21cvss 4.3epss 0.00
Gitea before 1.25.2 mishandles authorization for deletion of releases.
- risk 0.21cvss 4.3epss 0.00
In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log.
- risk 0.18cvss 2.7epss 0.00
Webhook Authorization Header Returned in Plaintext via API
- risk 0.18cvss 2.7epss 0.00
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
- risk 0.18cvss 2.7epss 0.00
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
- risk 0.16cvss 3.5epss 0.00
Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing…
- risk 0.13cvss 3.1epss 0.00
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
- risk 0.13cvss 3.1epss 0.00
In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.
- risk 0.07cvss 8.8epss 0.55
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.
- risk 0.03cvss 8.2epss 0.43
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.
- risk 0.01cvss 3.7epss 0.09
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.
- risk 0.00cvss 5.3epss 0.00
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.
- risk 0.00cvss 9.8epss 0.00
Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.
- risk 0.00cvss 7.5epss 0.00
Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.
- risk 0.00cvss 7.5epss 0.00
Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.
- risk 0.00cvss 7.5epss 0.00
Gitea versions before 1.25.5 allow a user to change another user's primary email address.
Page 6 of 8