Gitea Open Source Git Server vulnerabilities, page 2
97 vulnerabilities
Known vulnerabilities in Gitea Open Source Git Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-20912giteagitea+3
EPSS score0.46%
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.CVE-2026-20779giteagitea open source git server+1EPSS score0.48%
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.CVE-2026-20896giteagitea open source git server+1EPSS score2.76%
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.CVE-2026-20897giteagitea+3EPSS score0.46%
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.CVE-2026-20883giteagitea+3EPSS score0.36%
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.CVE-2026-20736giteagitea+2EPSS score0.43%
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.CVE-2026-0798giteagitea+2EPSS score0.27%
Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.CVE-2026-25038giteagitea open source git server+1EPSS score0.48%
Gitea 1.26.2 allows unauthorized users to access labels of private organizations.CVE-2026-25712giteagitea open source git server+1EPSS score0.48%
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.CVE-2026-25714giteagitea open source git server+1EPSS score0.34%
Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.CVE-2026-25779giteagitea open source git server+2EPSS score0.34%
Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.CVE-2026-25782giteagitea open source git server+1EPSS score0.39%
Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.CVE-2026-25718giteagitea open source git server+1EPSS score0.56%
Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.CVE-2026-56755giteagitea open source git server+2EPSS score0.17%
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package UploadCVE-2026-56654giteagitea open source git server+2EPSS score0.60%
Privilege Escalation via Access Token Scope Escalation in APICVE-2026-56657giteagitea open source git server+2EPSS score0.17%
Gitea SSH Key Parser Denial of ServiceCVE-2026-56750giteagitea open source git server+2EPSS score0.48%
Gitea Remember-Me Token Theft Not Invalidating Attacker SessionCVE-2026-56443giteagitea open source git server+2EPSS score0.53%
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118CVE-2026-58440giteagitea open source git server+1EPSS score0.48%
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)CVE-2026-58420giteagitea open source git server+1EPSS score0.47%
Local File Inclusion via file:// URI in Migration Restore