Code.Gitea.Io Gitea vulnerabilities

CVE-2026-20896 [CRITICAL] CWE-284 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` # Summary The Gitea Docker images ship an `app.ini` template that hard-codes: ``` REVERSE_PROXY_TRUSTED_PROXIES = * ``` The documented default for this setting, in `custom/conf/app.example.ini`, is `127.0.0.0/8,:

CVE-2022-30781 [HIGH] CWE-116 Shell command injection in gitea Shell command injection in gitea Gitea before 1.16.7 does not escape the shell out for `git fetch remote` allowing for shell command injection

CVE-2020-14144 [HIGH] CWE-78 Arbitrary Code Execution in Gitea Arbitrary Code Execution in Gitea The git hook feature in Gitea 1.1.0 through 1.12.5 allows for authenticated remote code execution.

CVE-2024-6886 [CRITICAL] CWE-79 Gitea Cross-site Scripting Vulnerability Gitea Cross-site Scripting Vulnerability Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.

CVE-2022-1058 [MEDIUM] CWE-601 Gitea Open Redirect Gitea Open Redirect Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.

CVE-2026-27771 [HIGH] CWE-862 Gitea has insufficient permission checks for Composer package source links Gitea has insufficient permission checks for Composer package source links ### CVE Description Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. ### Summary A critical vulnerability has been discovered in Gitea. It was already reported via ([email protected]) from

CVE-2021-45327 Capture-replay in Gitea in code.gitea.io/gitea Capture-replay in Gitea in code.gitea.io/gitea Capture-replay in Gitea in code.gitea.io/gitea

CVE-2021-45331 [CRITICAL] CWE-287 Reuse of one time passwords allowed in Gitea Reuse of one time passwords allowed in Gitea An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.

CVE-2026-20706 [MEDIUM] CWE-863 Gitea: Token scope bypass on web archive download endpoint Gitea: Token scope bypass on web archive download endpoint ## Summary PR #37698 added checkDownloadTokenScope to /raw/*, /media/*, and attachment download web endpoints. The /archive/* endpoint (repo.Download in routers/web/repo/repo.go:372) was not included in the fix. This endpoint accepts OAuth2 tokens via webAuth.AllowOAuth2 (registered at routers/web/web.go:1649-1652) but does not call checkDownload

CVE-2019-11576 [CRITICAL] CWE-287 Gitea Allows 1FA Even for 2FA-Enrolled Accounts Gitea Allows 1FA Even for 2FA-Enrolled Accounts Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.

CVE-2026-27775 [HIGH] CWE-863 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write ## Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High

CVE-2018-18926 [CRITICAL] CWE-94 Gitea Remote Code Execution (RCE) Gitea Remote Code Execution (RCE) Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

CVE-2026-58422 [HIGH] CWE-284 Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts ### Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated `Disable Account` ac

CVE-2026-28699 [HIGH] CWE-284 Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication ### Summary Gitea fails to enforce OAuth2 access token scopes when the token is submitted via HTTP Basic authentication instead of a Bearer token. An OAuth2 application granted only `read:user` can use the same token as `Authorization: Basic base64(:x-oauth-basic)` and perform write actions, including m

CVE-2026-22874 [CRITICAL] CWE-918 Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter ## Summary Gitea's default SSRF allow-list ([`MatchBuiltinExternal`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L26-L27), used by both webhook delivery and repository migrations) relies on Go's standard library [`net.IP.Is

CVE-2026-56654 [HIGH] CWE-287 Gitea: Privilege Escalation via Access Token Scope Escalation in API Gitea: Privilege Escalation via Access Token Scope Escalation in API Gitea's API endpoint for creating Personal Access Tokens (`POST /users/{username}/tokens`) is protected by a middleware (`reqBasicOrRevProxyAuth`) that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in the `Authorization: Basic

CVE-2026-58423 [HIGH] CWE-287 Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories ### Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized downl

CVE-2026-20897 Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

CVE-2018-15192 [HIGH] CWE-918 Gogs and Gitea SSRF Vulnerability Gogs and Gitea SSRF Vulnerability An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.

CVE-2026-20750 Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea