Vulnerabilidades do Gitea Gitea Open Source Git Server
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Gitea Gitea Open Source Git Server: 96 registro(s), com versões afetadas e correções.
CVE-2026-58420
Média · 4.4
CWE-284 13/08/2026
Local File Inclusion via file:// URI in Migration Restore
Local File Inclusion via file:// URI in Migration Restore
CVE-2026-58417
Alta · 7.5
CWE-284 13/08/2026
REST API exposes organization membership of private organizations to public
REST API exposes organization membership of private organizations to public
CVE-2026-58416
Alta · 7.1
CWE-280 13/08/2026
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
CVE-2026-58314
Alta · 7.7
CWE-918 13/08/2026
Two SSRF findings in Gitea 1.26.2
Two SSRF findings in Gitea 1.26.2
CVE-2026-57897
Média · 6.5
CWE-200 13/08/2026
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
CVE-2026-57894
Alta · 8.5
CWE-918 13/08/2026
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
CVE-2026-57886
Média · 5.9
CWE-639 13/08/2026
Cross-repository issue/comment attachment re-linking can expose private attachment content
Cross-repository issue/comment attachment re-linking can expose private attachment content
CVE-2026-56755
Média · 6.2
CWE-284 13/08/2026
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
CVE-2026-56750
Crítica · 9.1
CWE-284 13/08/2026
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
CVE-2026-56657
Média · 6.2
CWE-284 13/08/2026
Gitea SSH Key Parser Denial of Service
Gitea SSH Key Parser Denial of Service
CVE-2026-56654
Crítica · 9.8
CWE-284 13/08/2026
Privilege Escalation via Access Token Scope Escalation in API
Privilege Escalation via Access Token Scope Escalation in API
CVE-2026-56443
Crítica · 9.6
CWE-863 13/08/2026
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
CVE-2026-55987
Alta · 8.1
CWE-863 13/08/2026
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
CVE-2026-55986
Média · 5.4
CWE-284 13/08/2026
Email Management API Bypasses ManageCredentials Feature Restrictions
Email Management API Bypasses ManageCredentials Feature Restrictions
CVE-2026-55984
Baixa · 2.7
CWE-284 13/08/2026
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
CVE-2026-55982
Crítica · 9.1
CWE-200 13/08/2026
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
CVE-2026-54481
Alta · 7.5
CWE-295 13/08/2026
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
CVE-2026-50105
Média · 4.3
CWE-200 13/08/2026
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
CVE-2026-42931
Média · 6.5
CWE-770 13/08/2026
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
CVE-2026-24791
Alta · 8.1
CWE-863 13/08/2026
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
CVE-2026-24059
Média · 6.5
CWE-269 13/08/2026
Gitea runner registration-token GET endpoint performs a write under a read-only token scope
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.
CVE-2026-23603
Baixa · 3.1
CWE-918 13/08/2026
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
CVE-2026-58426
Crítica · 9.6
CWE-347 03/07/2026
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
CVE-2026-58424
Alta · 8.9
CWE-285 03/07/2026
Permanent Fork PR Workflow Approval Gate Bypass
Permanent Fork PR Workflow Approval Gate Bypass
CVE-2026-58423
Alta · 7.7
CWE-287 03/07/2026
LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories