Gitea

Latest CVEs · RSS

• CVE-2026-78433 2026-10-14
  Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repo
• CVE-2026-78231 2026-10-14
  When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpo
• CVE-2026-73814 2026-10-14
  Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can p
• CVE-2026-73804 2026-10-14
  Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the correspo
• CVE-2026-73802 2026-10-14
  Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, ex
• CVE-2026-73800 2026-10-14
  Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author c
• CVE-2026-73539 2026-10-14
  Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style ar
• CVE-2026-73535 2026-10-14
  Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenI
• CVE-2026-73273 2026-10-14
  Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-pu
• CVE-2026-73135 2026-10-14
  Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidde
• CVE-2026-73130 2026-10-14
  Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into templ
• CVE-2026-73126 2026-10-14
  Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A
• CVE-2026-71301 2026-10-14
  Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only
• CVE-2026-71184 2026-10-14
  Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run
• CVE-2026-70407 2026-10-14
  Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organizat
• CVE-2026-70406 2026-10-14
  Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can ro
• CVE-2026-70402 2026-10-14
  Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 00
• CVE-2026-70400 2026-10-14
  Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate
• CVE-2026-70396 2026-10-14
  Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes
• CVE-2026-68964 2026-10-14
  Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public key
• CVE-2026-68957 2026-10-14
  Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted
• CVE-2026-67577 2026-10-14
  Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users.
• CVE-2026-66877 2026-10-14
  Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement.
• CVE-2026-66874 2026-10-14
  For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters e
• CVE-2026-66853 2026-10-14
  Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction e