| CVE-2026-58508 |
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
|
9.1
Critical
|
Aug 13, 2026 |
| CVE-2026-58443 |
Public-only repository tokens can update private PR head branches
|
9.1
Critical
|
Aug 13, 2026 |
| CVE-2026-58433 |
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
|
9.1
Critical
|
Aug 13, 2026 |
| CVE-2026-56750 |
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
|
9.1
Critical
|
Aug 13, 2026 |
| CVE-2026-56443 |
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after…
|
9.6
Critical
|
Aug 13, 2026 |
| CVE-2026-56654 |
Privilege Escalation via Access Token Scope Escalation in API
|
9.8
Critical
|
Aug 13, 2026 |
| CVE-2026-55982 |
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
|
9.1
Critical
|
Aug 13, 2026 |
| CVE-2026-58426 |
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state…
|
9.6
Critical
|
Jul 3, 2026 |
| CVE-2026-58422 |
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
|
9.8
Critical
|
Jul 3, 2026 |
| CVE-2026-27780 |
Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input,…
|
9.8
Critical
|
Jul 3, 2026 |
| CVE-2026-26292 |
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations,…
|
9.8
Critical
|
Jul 3, 2026 |
| CVE-2026-26232 |
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during…
|
9.1
Critical
|
Jul 3, 2026 |
| CVE-2026-26247 |
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization,…
|
9.1
Critical
|
Jul 3, 2026 |
| CVE-2026-25718 |
Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template…
|
9.1
Critical
|
Jul 3, 2026 |
| CVE-2026-22874 |
Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering
|
9.6
Critical
|
Jul 3, 2026 |
| CVE-2026-22547 |
Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited…
|
9.1
Critical
|
Jul 3, 2026 |
| CVE-2026-20896 |
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any…
|
9.8
Critical
|
Jul 3, 2026 |
| CVE-2026-20706 |
Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web…
|
9.1
Critical
|
Jul 3, 2026 |
| CVE-2026-20912 |
Gitea does not properly validate repository ownership when linking attachments to releases
|
9.1
Critical
|
Jan 22, 2026 |
| CVE-2026-20897 |
Gitea does not properly validate repository ownership when deleting Git LFS locks
|
9.1
Critical
|
Jan 22, 2026 |
| CVE-2026-20750 |
Gitea does not properly validate project ownership in organization project operations
|
9.1
Critical
|
Jan 22, 2026 |
| CVE-2024-6886 |
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea…
|
10.0
Critical
|
Aug 6, 2024 |