Code.Gitea.Io Gitea vulnerabilities

CVE-2026-55982 [MEDIUM] CWE-200 Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes ### Summary The OIDC userinfo endpoint (`GET /login/oauth/userinfo`) accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims. A personal access token scoped only to `read:misc` can successfully retrieve user information from

CVE-2026-22874 [CRITICAL] CWE-918 Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter ## Summary Gitea's default SSRF allow-list ([`MatchBuiltinExternal`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L26-L27), used by both webhook delivery and repository migrations) relies on Go's standard library [`net.IP.Is

CVE-2026-20897 Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

CVE-2018-15192 [HIGH] CWE-918 Gogs and Gitea SSRF Vulnerability Gogs and Gitea SSRF Vulnerability An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.

CVE-2026-22547 [CRITICAL] CWE-20 Gitea repository creation accepts insufficiently validated fields Gitea repository creation accepts insufficiently validated fields Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.

CVE-2026-20750 Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

CVE-2026-26231 [HIGH] CWE-863 Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo ## Summary Any authenticated low-privilege user with read access to a repository can push arbitrary commits directly to that repository, bypassing all write-access checks. ## Vulnerability Gitea's "Allow edits from maintainers" PR option can

CVE-2026-56750 [CRITICAL] CWE-613 Gitea Remember-Me Token Theft Not Invalidating Attacker Session Gitea Remember-Me Token Theft Not Invalidating Attacker Session The vulnerability is in the Remember-Me (gitea_incredible) token validation logic, specifically when handling a compromised token (hash mismatch). The vulnerable function is this one: https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L33-L64 ### Affected Endpoint POST `/user/

CVE-2026-22555 [HIGH] CWE-863 Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration ## Summary The API endpoint `POST /api/v1/repos/{owner}/{repo}/forks` only checks `IsOrgMember()` when a user forks a repository into an organization, but does not check `CanCreateOrgRepo()`. The web UI fork handler correctly checks both. This allows a read-only organization member — in a team with `can_create_

CVE-2026-58426 [CRITICAL] CWE-347 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write ### Summary Gitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the original HMAC signature. An attacker with permissio

CVE-2026-24791 [MEDIUM] CWE-863 Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes ## Summary Many authenticated self routes under `/api/v1/user/...` do not enforce the `public-only` token restriction. As a result, a token or OAuth grant marked `public-only`, but otherwise carrying the route-required read/write scope category, can access or modify private accou

CVE-2026-25718 [CRITICAL] CWE-59 Gitea template repository generation follows unsafe filesystem paths Gitea template repository generation follows unsafe filesystem paths Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.

CVE-2026-20912 Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

CVE-2026-58419 [MEDIUM] CWE-200 Gitea: Notification API leaks private issue metadata after access revocation Gitea: Notification API leaks private issue metadata after access revocation # Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation, the `subject

CVE-2026-28744 [HIGH] CWE-863 Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens ### Summary Gitea v1.26.1 enforces repository-scoped access-token permissions on repository operations. In the Git Smart HTTP path, however, this check runs only when the token is presented via HTTP Basic authentication — `CheckRepoScopedToken()` returns early unless `ctx.IsBasicAuth` is true — so the same token sent as `Author

CVE-2021-45330 [CRITICAL] CWE-269 Improper Privilege Management in Gitea Improper Privilege Management in Gitea An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse.

CVE-2026-58436 [HIGH] CWE-1333 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests ### Summary The Locale middleware that runs in front of every unauthenticated request calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing a size or shape filter. The underlying parser has quadratic-time behaviour on lon

CVE-2026-57894 [HIGH] CWE-918 Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration # Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration ## Summary Gitea validates the user-supplied repository migration U

CVE-2026-56443 [MEDIUM] CWE-863 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 ## Summary After [PR #37118](https://github.com/go-gitea/gitea/pull/37118) / **CVE-2026-25714** (`fix: Unify public-only token filtering in API queries and repo access chec

CVE-2026-55987 [HIGH] CWE-863 Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) ## Description Gitea's OAuth2 sign-in callback reactivates a deactivated user account (`IsActive=false`) when the user signs in through an authentication source that does not issue refresh token