Gitea Open Source Git Server vulnerabilities, page 4
97 vulnerabilities
Known vulnerabilities in Gitea Open Source Git Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-58314giteagitea open source git server+2
EPSS score0.40%
Two SSRF findings in Gitea 1.26.2CVE-2026-58443giteagitea open source git server+2EPSS score0.58%
Public-only repository tokens can update private PR head branchesCVE-2026-58442giteagitea open source git server+2EPSS score0.43%
Repository migration SSRF via multi-answer DNS allow-list bypassCVE-2026-58511giteagitea open source git server+2EPSS score0.39%
Webhook Authorization Header Returned in Plaintext via APICVE-2026-58421giteagitea open source git server+1EPSS score0.58%
Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of serviceCVE-2026-58424giteagitea open source git server+1EPSS score0.37%
Permanent Fork PR Workflow Approval Gate BypassCVE-2026-58507giteagitea open source git server+2EPSS score0.38%
Private Repository Existence Disclosure via go-get Meta EndpointCVE-2026-58436giteagitea open source git server+2EPSS score0.61%
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsCVE-2026-58444giteagitea open source git server+2EPSS score0.36%
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contentsCVE-2026-58419giteagitea open source git server+1EPSS score0.51%
Notification API leaks private issue metadata after access revocationCVE-2026-58431giteagitea open source git server+1EPSS score0.33%
Public-only API token restriction is not enforced on team API routesCVE-2026-58416giteagitea open source git server+1EPSS score0.31%
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)CVE-2026-27771giteagitea open source git server+1EPSS score1.39%
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.CVE-2026-27779giteagitea open source git server+1EPSS score0.58%
Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.CVE-2026-27761giteagitea open source git server+1EPSS score0.37%
Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.CVE-2026-27780giteagitea open source git server+1EPSS score0.64%
Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.CVE-2026-27660giteagitea open source git server+3EPSS score0.45%
Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.CVE-2026-27657giteagitea open source git server+1EPSS score0.45%
Gitea versions before 1.25.5 allow a user to change another user's primary email address.CVE-2026-27775giteagitea open source git server+1EPSS score0.52%
Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.CVE-2026-27783giteagitea open source git server+1EPSS score0.34%
Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.