Gitea vulnerabilities, page 5
221 vulnerabilities
Known vulnerabilities in Gitea products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
MediumCVE-2022-38795gitea +1 moregitea giteaIn Gitea through 1.17.1, repo cloning can occur in the migration function.EPSS0.56%MediumCVE-2022-38183ubuntu · golang-code.gitea-git +3 moreubuntu golang-code.gitea-gitIn Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.EPSS0.86%HighCVE-2022-30781gitea +1 moregitea giteaGitea before 1.16.7 does not escape git fetch remote.EPSS87.93%CriticalCVE-2024-6886chainguard · gitness +3 moreInproper Sanitation of field leading to stored XSSImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.EPSS32.97%MediumCVE-2019-1000002gitea +1 moregitea giteaGitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any" repository including self-created ones.. This vulnerability appears to have been fixed in 1.6.3, 1.7.0-rc2.EPSS1.11%CriticalCVE-2019-11576ubuntu · golang-code.gitea-git +2 moreubuntu golang-code.gitea-gitGitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.EPSS1.77%HighCVE-2019-11229gitea +1 moregitea giteamodels/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.EPSS54.95%HighCVE-2019-11228gitea +1 moregitea gitearepo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress.EPSS1.35%MediumCVE-2019-1010314ubuntu · golang-code.gitea-git +2 moreubuntu golang-code.gitea-gitGitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.EPSS0.85%MediumCVE-2019-1010261ubuntu · golang-code.gitea-git +2 moreubuntu golang-code.gitea-gitGitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later.EPSS0.84%HighCVE-2019-10330gitea +2 moregitea giteaJenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.EPSS2.14%HighCVE-2026-54481gitea · gitea open source git server +2 moreInternal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)EPSS0.30%MediumCVE-2026-105268giteaGitea issue attachment API allows changing comment attachmentsThe Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.EPSS0.20%HighCVE-2026-105267giteaGitea tag delete route deletes releases without release permissionThe Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion.EPSS0.38%CriticalCVE-2026-73278giteaGitea WebAuthn bypass during OAuth and OIDC sign-inGitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.EPSS0.47%MediumCVE-2026-59763gitea · gitea open source git server +2 moreUnbounded Arch package file metadata can cause resource amplification in Gitea package uploadsEPSS0.41%HighCVE-2026-59765gitea · gitea open source git serverSSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud MetadataEPSS0.50%HighCVE-2026-86684giteaGitea push mirror local path check uses the repository ownerThe Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.EPSS0.11%LowCVE-2026-55984gitea · gitea open source git server +2 moreNull Pointer Dereference in AddTime API Causes Authenticated Denial of ServiceEPSS0.46%CriticalCVE-2026-55982gitea · gitea open source git server +2 moreOIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token ScopesEPSS0.51%