Vulnerabilidades de Gitea

CVE-2026-22547 Crítica · 9.1 CWE-20 03/07/2026

Gitea repository creation accepts invalid field values

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.

CVE-2026-20909 Média · 5.3 CWE-284 03/07/2026

Gitea tracked-time list endpoint has insufficient permission checks

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.

CVE-2026-20896 Crítica · 9.8 CWE-284 03/07/2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

CVE-2026-20779 Alta · 7.1 CWE-294 03/07/2026

Gitea TOTP single-use enforcement defect allows OTP replay

Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.

CVE-2026-20706 Crítica · 9.1 CWE-284 03/07/2026

Gitea repository archive downloads bypass token scope checks

Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.

CVE-2026-58053 Crítica · 9.9 CWE-269 27/06/2026

Escalonamento de privilégios no act_runner do Gitea (backend Docker) via container.options

O act_runner do Gitea com o backend Docker (até a versão 0.262.0 do act) repassa a string container.options de um workflow para o HostConfig do contêiner do job Docker e, quando configurado com privileged: false, desativa apenas a flag Privileged, mantendo inalteradas opções mescladas como --pid=host, --cap-add e --security-opt. Um usuário que consegue executar um workflow em um runner baseado em Docker pode criar um contêiner de job com namespaces do host e capacidades amplas e escapar para o host como root, apesar de o modo privilegiado estar desativado.

CVE-2026-20912 Crítica · 9.1 CWE-284 22/01/2026

Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.

CVE-2026-20904 Média · 6.5 CWE-284 22/01/2026

Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

CVE-2026-20897 Crítica · 9.1 CWE-284 22/01/2026

Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.

CVE-2026-20888 Média · 4.3 CWE-284 22/01/2026

Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users.

CVE-2026-20883 Média · 6.5 CWE-284 22/01/2026

Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure

Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.

CVE-2026-20800 Média · 6.5 CWE-200 22/01/2026

Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.

CVE-2026-20750 Crítica · 9.1 CWE-284 22/01/2026

Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)

Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.

CVE-2026-20736 Alta · 7.5 CWE-284 22/01/2026

Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check

Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.

CVE-2026-0798 Baixa · 3.5 CWE-284 22/01/2026

Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.

CVE-2025-69413 Média · 5.3 CWE-204 01/01/2026

Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

CVE-2025-68946 Média · 5.4 CWE-79 26/12/2025

Cross-site Scripting (XSS) em Gitea

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

CVE-2025-68945 Média · 5.3 CWE-359 26/12/2025

In Gitea before 1.21.2, an anonymous user can visit a private user's project.

CVE-2025-68944 Média · 5.3 CWE-441 26/12/2025

Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access…

Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.

CVE-2025-68943 Média · 5.3 CWE-497 26/12/2025

Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example)…

Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.

CVE-2025-68942 Média · 5.4 CWE-79 26/12/2025

Cross-site Scripting (XSS) em Gitea

Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.

CVE-2025-68941 Média · 5.3 CWE-863 26/12/2025

Incorrect Authorization em Gitea

Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.

CVE-2025-68940 Média · 5.3 CWE-863 26/12/2025

Incorrect Authorization em Gitea

In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.

CVE-2025-68939 Média · 5.3 CWE-424 26/12/2025

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions…

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

CVE-2025-68938 Média · 5.3 CWE-863 25/12/2025

Incorrect Authorization em Gitea

Gitea before 1.25.2 mishandles authorization for deletion of releases.