Gitea Open Source Git Server vulnerabilities, page 5
97 vulnerabilities
Known vulnerabilities in Gitea Open Source Git Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-57894giteagitea open source git server+2
EPSS score0.36%
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository ExfiltrationCVE-2026-57897giteagitea open source git server+2EPSS score0.41%
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIsCVE-2026-57886giteagitea open source git server+2EPSS score0.31%
Cross-repository issue/comment attachment re-linking can expose private attachment contentCVE-2026-22547giteagitea open source git server+1EPSS score0.52%
Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.CVE-2026-22874giteagitea open source git server+1EPSS score0.46%
Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.CVE-2026-22555giteagitea open source git server+1EPSS score0.43%
Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.CVE-2026-24451giteagitea open source git server+1EPSS score0.48%
Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.CVE-2026-24059giteagitea open source git serverEPSS score0.41%
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.CVE-2026-24690giteagitea open source git server+1EPSS score0.45%
Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.CVE-2026-24791giteagitea open source git server+1EPSS score0.45%
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routesCVE-2026-28740giteagitea open source git server+2EPSS score0.32%
Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.CVE-2026-28737giteagitea open source git server+1EPSS score0.43%
Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.CVE-2026-28705giteagitea open source git server+1EPSS score0.45%
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.CVE-2026-28744giteagitea open source git server+1EPSS score0.45%
Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.CVE-2026-28699giteagitea open source git server+1EPSS score0.55%
Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.CVE-2026-50105giteagitea open source git server+2EPSS score0.36%
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)CVE-2026-23603giteagitea open source git server+2EPSS score0.29%
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim