Vulnerabilidades de Gitea

CVE-2026-56750 Crítica · 9.1 CWE-284 13/08/2026

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

CVE-2026-56657 Média · 6.2 CWE-284 13/08/2026

Gitea SSH Key Parser Denial of Service

CVE-2026-56654 Crítica · 9.8 CWE-284 13/08/2026

Privilege Escalation via Access Token Scope Escalation in API

CVE-2026-56443 Crítica · 9.6 CWE-863 13/08/2026

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

CVE-2026-55987 Alta · 8.1 CWE-863 13/08/2026

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

CVE-2026-55986 Média · 5.4 CWE-284 13/08/2026

Email Management API Bypasses ManageCredentials Feature Restrictions

CVE-2026-55984 Baixa · 2.7 CWE-284 13/08/2026

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

CVE-2026-55982 Crítica · 9.1 CWE-200 13/08/2026

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

CVE-2026-54481 Alta · 7.5 CWE-295 13/08/2026

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

CVE-2026-50105 Média · 4.3 CWE-200 13/08/2026

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

CVE-2026-42931 Média · 6.5 CWE-770 13/08/2026

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

CVE-2026-24791 Alta · 8.1 CWE-863 13/08/2026

Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

CVE-2026-24059 Média · 6.5 CWE-269 13/08/2026

Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.

CVE-2026-23603 Baixa · 3.1 CWE-918 13/08/2026

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

CVE-2026-34966 Alta · 7.6 CWE-918 05/08/2026

Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.

CVE-2026-58426 Crítica · 9.6 CWE-347 03/07/2026

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

CVE-2026-58424 Alta · 8.9 CWE-285 03/07/2026

Permanent Fork PR Workflow Approval Gate Bypass

CVE-2026-58423 Alta · 7.7 CWE-287 03/07/2026

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

CVE-2026-58422 Crítica · 9.8 CWE-284 03/07/2026

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

CVE-2026-58421 Alta · 7.5 CWE-284 03/07/2026

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

CVE-2026-58419 Alta · 7.5 CWE-200 03/07/2026

Notification API leaks private issue metadata after access revocation

CVE-2026-58418 Média · 6.5 CWE-918 03/07/2026

SSRF via HTTP Redirect in Repository Migration

CVE-2026-28744 Alta · 8.1 CWE-863 03/07/2026

Gitea Git smart HTTP bypasses repository token scopes for bearer tokens

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

CVE-2026-28740 Alta · 7.1 CWE-639 03/07/2026

Gitea LFS object reuse bypasses Code-unit authorization

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

CVE-2026-28737 Alta · 8.7 CWE-79 03/07/2026

Gitea 3D file viewer allows stored XSS through glTF extensionsRequired

Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.