Gitea vulnerabilities

CVE-2026-56750 Critical · 9.1 CWE-284 Aug 13, 2026

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

CVE-2026-56657 Medium · 6.2 CWE-284 Aug 13, 2026

Gitea SSH Key Parser Denial of Service

CVE-2026-56654 Critical · 9.8 CWE-284 Aug 13, 2026

Privilege Escalation via Access Token Scope Escalation in API

CVE-2026-56443 Critical · 9.6 CWE-863 Aug 13, 2026

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

CVE-2026-55987 High · 8.1 CWE-863 Aug 13, 2026

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

CVE-2026-55986 Medium · 5.4 CWE-284 Aug 13, 2026

Email Management API Bypasses ManageCredentials Feature Restrictions

CVE-2026-55984 Low · 2.7 CWE-284 Aug 13, 2026

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

CVE-2026-55982 Critical · 9.1 CWE-200 Aug 13, 2026

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

CVE-2026-54481 High · 7.5 CWE-295 Aug 13, 2026

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

CVE-2026-50105 Medium · 4.3 CWE-200 Aug 13, 2026

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

CVE-2026-42931 Medium · 6.5 CWE-770 Aug 13, 2026

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

CVE-2026-24791 High · 8.1 CWE-863 Aug 13, 2026

Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

CVE-2026-24059 Medium · 6.5 CWE-269 Aug 13, 2026

Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.

CVE-2026-23603 Low · 3.1 CWE-918 Aug 13, 2026

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

CVE-2026-34966 High · 7.6 CWE-918 Aug 5, 2026

Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.

CVE-2026-58426 Critical · 9.6 CWE-347 Jul 3, 2026

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

CVE-2026-58424 High · 8.9 CWE-285 Jul 3, 2026

Permanent Fork PR Workflow Approval Gate Bypass

CVE-2026-58423 High · 7.7 CWE-287 Jul 3, 2026

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

CVE-2026-58422 Critical · 9.8 CWE-284 Jul 3, 2026

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

CVE-2026-58421 High · 7.5 CWE-284 Jul 3, 2026

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

CVE-2026-58419 High · 7.5 CWE-200 Jul 3, 2026

Notification API leaks private issue metadata after access revocation

CVE-2026-58418 Medium · 6.5 CWE-918 Jul 3, 2026

SSRF via HTTP Redirect in Repository Migration

CVE-2026-28744 High · 8.1 CWE-863 Jul 3, 2026

Gitea Git smart HTTP bypasses repository token scopes for bearer tokens

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

CVE-2026-28740 High · 7.1 CWE-639 Jul 3, 2026

Gitea LFS object reuse bypasses Code-unit authorization

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

CVE-2026-28737 High · 8.7 CWE-79 Jul 3, 2026

Gitea 3D file viewer allows stored XSS through glTF extensionsRequired

Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.