Code.Gitea.Io Gitea vulnerabilities

CVE-2026-20896 [CRITICAL] CWE-284 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` # Summary The Gitea Docker images ship an `app.ini` template that hard-codes: ``` REVERSE_PROXY_TRUSTED_PROXIES = * ``` The documented default for this setting, in `custom/conf/app.example.ini`, is `127.0.0.0/8,:

CVE-2022-30781 [HIGH] CWE-116 Shell command injection in gitea Shell command injection in gitea Gitea before 1.16.7 does not escape the shell out for `git fetch remote` allowing for shell command injection

CVE-2020-14144 [HIGH] CWE-78 Arbitrary Code Execution in Gitea Arbitrary Code Execution in Gitea The git hook feature in Gitea 1.1.0 through 1.12.5 allows for authenticated remote code execution.

CVE-2024-6886 [CRITICAL] CWE-79 Gitea Cross-site Scripting Vulnerability Gitea Cross-site Scripting Vulnerability Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.

CVE-2022-1058 [MEDIUM] CWE-601 Gitea Open Redirect Gitea Open Redirect Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.

CVE-2026-27771 [HIGH] CWE-862 Gitea has insufficient permission checks for Composer package source links Gitea has insufficient permission checks for Composer package source links ### CVE Description Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. ### Summary A critical vulnerability has been discovered in Gitea. It was already reported via ([email protected]) from

CVE-2021-45331 [CRITICAL] CWE-287 Reuse of one time passwords allowed in Gitea Reuse of one time passwords allowed in Gitea An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.

CVE-2021-45327 Capture-replay in Gitea in code.gitea.io/gitea Capture-replay in Gitea in code.gitea.io/gitea Capture-replay in Gitea in code.gitea.io/gitea

CVE-2019-11576 [CRITICAL] CWE-287 Gitea Allows 1FA Even for 2FA-Enrolled Accounts Gitea Allows 1FA Even for 2FA-Enrolled Accounts Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.

CVE-2026-20706 [MEDIUM] CWE-863 Gitea: Token scope bypass on web archive download endpoint Gitea: Token scope bypass on web archive download endpoint ## Summary PR #37698 added checkDownloadTokenScope to /raw/*, /media/*, and attachment download web endpoints. The /archive/* endpoint (repo.Download in routers/web/repo/repo.go:372) was not included in the fix. This endpoint accepts OAuth2 tokens via webAuth.AllowOAuth2 (registered at routers/web/web.go:1649-1652) but does not call checkDownload

CVE-2026-26292 [CRITICAL] CWE-284 Gitea LFS mirror operations bypass migration HTTP transport protections Gitea LFS mirror operations bypass migration HTTP transport protections Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

CVE-2026-27780 [CRITICAL] CWE-863 Gitea pre-receive hook scanner errors allow branch-protection bypass Gitea pre-receive hook scanner errors allow branch-protection bypass Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

CVE-2026-56654 [HIGH] CWE-287 Gitea: Privilege Escalation via Access Token Scope Escalation in API Gitea: Privilege Escalation via Access Token Scope Escalation in API Gitea's API endpoint for creating Personal Access Tokens (`POST /users/{username}/tokens`) is protected by a middleware (`reqBasicOrRevProxyAuth`) that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in the `Authorization: Basic

CVE-2026-27775 [HIGH] CWE-863 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write ## Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High

CVE-2018-18926 [CRITICAL] CWE-94 Gitea Remote Code Execution (RCE) Gitea Remote Code Execution (RCE) Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

CVE-2026-58422 [HIGH] CWE-284 Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts ### Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated `Disable Account` ac

CVE-2026-28699 [HIGH] CWE-284 Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication ### Summary Gitea fails to enforce OAuth2 access token scopes when the token is submitted via HTTP Basic authentication instead of a Bearer token. An OAuth2 application granted only `read:user` can use the same token as `Authorization: Basic base64(:x-oauth-basic)` and perform write actions, including m

CVE-2026-26232 [CRITICAL] CWE-294 Gitea OAuth2 authorization codes can be reused after expiry Gitea OAuth2 authorization codes can be reused after expiry Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.

CVE-2026-26247 [CRITICAL] CWE-284 Gitea OAuth2 PKCE S256 verifier bypass Gitea OAuth2 PKCE S256 verifier bypass Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

CVE-2026-58423 [HIGH] CWE-287 Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories ### Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized downl