Go Gitea: 25 Vulnerabilities Including SSRF and Auth Bypass Disclosed Together
Key findings • 25 vulnerabilities disclosed in Go Gitea on August 13, 2026, including critical SSRF and authorization bypasses. • Multiple SSRF flaws allow attackers to trick servers into mak…
Key findings
- 25 vulnerabilities disclosed in Go Gitea on August 13, 2026, including critical SSRF and authorization bypasses.
- Multiple SSRF flaws allow attackers to trick servers into making unintended requests, potentially accessing internal resources.
- Numerous authorization and access control issues enable unauthorized access to private repositories and sensitive information.
- Information disclosure vulnerabilities permit the leakage of private repository existence, metadata, and member lists.
- Go Gitea version 1.21.0 addresses all disclosed vulnerabilities; immediate updates are recommended.
On August 13, 2026, Go Gitea disclosed a significant batch of 25 vulnerabilities affecting its self-hosted Git service. This coordinated disclosure event highlights a range of security weaknesses, including critical Server-Side Request Forgery (SSRF) flaws, authorization bypasses, and information disclosure vulnerabilities. The sheer volume and variety of these issues underscore the importance of prompt patching for Gitea instances.
Several vulnerabilities center around SSRF, a class of flaws where an attacker can trick a server into making unintended requests to internal or external resources. CVE-2026-59765 allows SSRF via migration asset downloads, potentially reading internal files and cloud metadata. Similarly, CVE-2026-58508 details two SSRF vulnerabilities in Gitea's migration and mirroring features, exploiting DNS rebinding and missing re-validation. Another SSRF vulnerability, CVE-2026-58442, arises from a multi-answer DNS allow-list bypass during repository migration. CVE-2026-58441 also involves SSRF in the restore-repo functionality due to an unsanitized pull_request.yml Head.CloneURL.
Authorization and access control appear to be a major theme across this batch. CVE-2026-58445 describes a cross-repository oracle for label enumeration via an unscoped DeleteIssueLabel API. CVE-2026-58444 details a personal access token scope bypass on the repository home page, leading to the disclosure of private repository contents. Public-only repository tokens can be used to update private PR head branches, as noted in CVE-2026-58443. CVE-2026-58438 points to a cross-repository Insecure Direct Object Reference (IDOR) in issue-dependency removal, allowing tampering with private repositories. CVE-2026-58433 reveals that a team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting. Furthermore, CVE-2026-58431 indicates that public-only API token restrictions are not enforced on team API routes, and CVE-2026-58429 describes a public-only personal access token scope bypass in organization and permission endpoints. CVE-2026-58432 is a critical vulnerability involving missing authorization and bypasses through user-controlled keys and incorrect permission assignments, leading to exposure of sensitive information.
Information disclosure is another significant concern. CVE-2026-58507 describes how private repository existence can be disclosed via the go-get meta endpoint. CVE-2026-58436 details a quadratic-time Denial of Service (DoS) vulnerability via the Locale middleware on unauthenticated requests, triggered by parsing the Accept-Language header. CVE-2026-58435 highlights a privilege escalation in Gitea LFS Deploy-Key usage. CVE-2026-58434 indicates that private repository metadata remains accessible even after access revocation. CVE-2026-58427 shows that the private organization member list can be leaked via the /members API endpoint, stemming from an incomplete fix. Finally, CVE-2026-58425 reveals that OAuth token introspection returns metadata of tokens issued to other clients, violating RFC 7662.
Other notable vulnerabilities include CVE-2026-59763, which allows resource amplification in Gitea package uploads due to unbounded arch package file metadata. CVE-2026-58511 points out that webhook authorization headers are returned in plaintext via the API. CVE-2026-58510 notes that a fix for stale watches on public to private repository transitions was not applied to the API EditRepo path. CVE-2026-58440 describes how webhooks created by collaborators continue to fire after their access is revoked, potentially leading to ongoing exfiltration. CVE-2026-58439 details a branch protection bypass via PR retargeting that preserves a stale 'official' approval flag. CVE-2026-58437 allows repository visibility manipulation via Git push options. CVE-2026-58428 describes a release attachment extension allowlist bypass via the web release edit form.
The Go Gitea team has addressed these vulnerabilities in version 1.21.0. Users are strongly advised to update to this version or later to mitigate these risks. The broad nature of these flaws, affecting core functionalities like repository access, migration, and API interactions, necessitates immediate attention from all Gitea administrators.
This extensive batch of vulnerabilities serves as a critical reminder for Gitea users to maintain up-to-date instances and regularly review access controls and configurations. The coordinated disclosure indicates a thorough internal or external audit, and prompt patching is the most effective defense against potential exploitation.