Gitea Open Source Git Server vulnerabilities
97 vulnerabilities
Known vulnerabilities in Gitea Open Source Git Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2024-6886chainguardgitness+3
EPSS score32.97%
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.CVE-2026-54481giteagitea open source git server+2EPSS score0.30%
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)CVE-2026-59763giteagitea open source git server+2EPSS score0.41%
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploadsCVE-2026-59765giteagitea open source git serverEPSS score0.50%
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud MetadataCVE-2026-55984giteagitea open source git server+2EPSS score0.46%
Null Pointer Dereference in AddTime API Causes Authenticated Denial of ServiceCVE-2026-55982giteagitea open source git server+2EPSS score0.51%
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token ScopesCVE-2026-55986giteagitea open source git serverEPSS score0.32%
Email Management API Bypasses ManageCredentials Feature RestrictionsCVE-2026-55987giteagitea open source git server+2EPSS score0.41%
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)CVE-2026-26292giteagitea open source git server+1EPSS score0.65%
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.CVE-2026-26232giteagitea open source git server+1EPSS score0.50%
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.CVE-2026-26231giteagitea open source git server+1EPSS score0.35%
Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.CVE-2026-26247giteagitea open source git server+1EPSS score0.50%
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.CVE-2026-26307giteagitea open source git server+1EPSS score0.63%
Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.CVE-2026-42931giteagitea open source git server+2EPSS score0.53%
Denial of Service via Unbounded io.ReadAll in NPM Package Tag EndpointCVE-2026-20909giteagitea open source git server+1EPSS score0.29%
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.CVE-2026-20888giteagitea+3EPSS score0.33%
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users.CVE-2026-20800giteagitea+3EPSS score0.40%
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.CVE-2026-20706giteagitea open source git server+1EPSS score0.56%
Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.CVE-2026-20750giteagitea+3EPSS score0.43%
Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.CVE-2026-20904giteagitea+3EPSS score0.30%
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.