CVE Intelligence

Gitea vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Gitea products: 175 record(s), with severity, exploitation and fixes.

Gitea Open Source Git Server 96Gitea 86Act Runner 1Gitea Runner 1

Exploited only (KEV) →

CVE-2026-58443 Critical · 9.1 CWE-863 Aug 13, 2026
Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches
CVE-2026-58442 Medium · 6.5 CWE-200 Aug 13, 2026
Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass
CVE-2026-58441 Medium · 6.3 CWE-918 Aug 13, 2026
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
CVE-2026-58440 Medium · 6.8 CWE-284 Aug 13, 2026
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
CVE-2026-58439 High · 8.1 CWE-284 Aug 13, 2026
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
CVE-2026-58438 High · 7.5 CWE-862 Aug 13, 2026
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
CVE-2026-58437 High · 7.1 CWE-284 Aug 13, 2026
Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options
CVE-2026-58436 High · 7.5 CWE-407 Aug 13, 2026
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
CVE-2026-58435 Medium · 5.4 CWE-266 Aug 13, 2026
Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation
CVE-2026-58434 High · 7.5 CWE-200 Aug 13, 2026
Private Repository Metadata Remains Accessible After Access Revocation
Private Repository Metadata Remains Accessible After Access Revocation
CVE-2026-58433 Critical · 9.1 CWE-862 Aug 13, 2026
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
CVE-2026-58432 Medium · 5.9 CWE-200 Aug 13, 2026
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
CVE-2026-58431 Medium · 4.3 CWE-863 Aug 13, 2026
Public-only API token restriction is not enforced on team API routes
Public-only API token restriction is not enforced on team API routes
CVE-2026-58429 Medium · 4.9 CWE-284 Aug 13, 2026
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
CVE-2026-58428 Medium · 6.5 CWE-424 Aug 13, 2026
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
CVE-2026-58427 High · 7.5 CWE-200 Aug 13, 2026
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
CVE-2026-58425 Medium · 4.3 CWE-200 Aug 13, 2026
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
CVE-2026-58420 Medium · 4.4 CWE-284 Aug 13, 2026
Local File Inclusion via file:// URI in Migration Restore
Local File Inclusion via file:// URI in Migration Restore
CVE-2026-58417 High · 7.5 CWE-284 Aug 13, 2026
REST API exposes organization membership of private organizations to public
REST API exposes organization membership of private organizations to public
CVE-2026-58416 High · 7.1 CWE-280 Aug 13, 2026
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
CVE-2026-58314 High · 7.7 CWE-918 Aug 13, 2026
Two SSRF findings in Gitea 1.26.2
Two SSRF findings in Gitea 1.26.2
CVE-2026-57897 Medium · 6.5 CWE-200 Aug 13, 2026
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
CVE-2026-57894 High · 8.5 CWE-918 Aug 13, 2026
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
CVE-2026-57886 Medium · 5.9 CWE-639 Aug 13, 2026
Cross-repository issue/comment attachment re-linking can expose private attachment content
Cross-repository issue/comment attachment re-linking can expose private attachment content
CVE-2026-56755 Medium · 6.2 CWE-284 Aug 13, 2026
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload