| CVE-2026-58427 |
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
|
7.5
High
|
Aug 13, 2026 |
| CVE-2026-58417 |
REST API exposes organization membership of private organizations to public
|
7.5
High
|
Aug 13, 2026 |
| CVE-2026-58420 |
Local File Inclusion via file:// URI in Migration Restore
|
4.4
Medium
|
Aug 13, 2026 |
| CVE-2026-58425 |
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
|
4.3
Medium
|
Aug 13, 2026 |
| CVE-2026-58416 |
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
|
7.1
High
|
Aug 13, 2026 |
| CVE-2026-58314 |
Two SSRF findings in Gitea 1.26.2
|
7.7
High
|
Aug 13, 2026 |
| CVE-2026-57894 |
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository…
|
8.5
High
|
Aug 13, 2026 |
| CVE-2026-57897 |
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
|
6.5
Medium
|
Aug 13, 2026 |
| CVE-2026-56755 |
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
|
6.2
Medium
|
Aug 13, 2026 |
| CVE-2026-57886 |
Cross-repository issue/comment attachment re-linking can expose private attachment content
|
5.9
Medium
|
Aug 13, 2026 |
| CVE-2026-56657 |
Gitea SSH Key Parser Denial of Service
|
6.2
Medium
|
Aug 13, 2026 |
| CVE-2026-56750 |
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
|
9.1
Critical
|
Aug 13, 2026 |
| CVE-2026-55987 |
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix…
|
8.1
High
|
Aug 13, 2026 |
| CVE-2026-56443 |
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after…
|
9.6
Critical
|
Aug 13, 2026 |
| CVE-2026-56654 |
Privilege Escalation via Access Token Scope Escalation in API
|
9.8
Critical
|
Aug 13, 2026 |
| CVE-2026-55986 |
Email Management API Bypasses ManageCredentials Feature Restrictions
|
5.4
Medium
|
Aug 13, 2026 |
| CVE-2026-55982 |
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
|
9.1
Critical
|
Aug 13, 2026 |
| CVE-2026-55984 |
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
|
2.7
Low
|
Aug 13, 2026 |
| CVE-2026-50105 |
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
|
4.3
Medium
|
Aug 13, 2026 |
| CVE-2026-54481 |
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
|
7.5
High
|
Aug 13, 2026 |
| CVE-2026-23603 |
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
|
3.1
Low
|
Aug 13, 2026 |
| CVE-2026-42931 |
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
|
6.5
Medium
|
Aug 13, 2026 |
| CVE-2026-58426 |
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state…
|
9.6
Critical
|
Jul 3, 2026 |
| CVE-2026-58422 |
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
|
9.8
Critical
|
Jul 3, 2026 |
| CVE-2026-58423 |
LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
|
7.7
High
|
Jul 3, 2026 |