Code.Gitea.Io Gitea vulnerabilities

CVE-2026-20904 Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

CVE-2021-28378 [MEDIUM] CWE-79 Cross-site Scripting in Gitea Cross-site Scripting in Gitea Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.

CVE-2019-1000002 [MEDIUM] CWE-284 Gitea Arbitrary File Delete Vulnerability Gitea Arbitrary File Delete Vulnerability Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any" repository including self-created ones. This vulnerability appears to have been fixed

CVE-2022-0905 [HIGH] CWE-862 Gitea Missing Authorization vulnerability Gitea Missing Authorization vulnerability Gitea 1.16.3 and prior is vulnerable to missing authorization. A patch is available as part of the 1.16.4 release.

CVE-2022-27313 [HIGH] Arbitrary file deletion in gitea Arbitrary file deletion in gitea An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file.

CVE-2022-38795 [MEDIUM] Gitea erroneous repo clones Gitea erroneous repo clones In Gitea through 1.17.1, repo cloning can occur in the migration function.

CVE-2025-69413 [MEDIUM] CWE-204 Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

CVE-2025-68941 [MEDIUM] CWE-863 Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.

CVE-2021-29134 [MEDIUM] CWE-22 Path Traversal in Gitea Path Traversal in Gitea The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.

CVE-2025-68945 [MEDIUM] CWE-359 Gitea: anonymous user can visit private user's project Gitea: anonymous user can visit private user's project In Gitea before 1.21.2, an anonymous user can visit a private user's project.

CVE-2025-68938 [MEDIUM] CWE-863 Gitea mishandles authorization for deletion of releases Gitea mishandles authorization for deletion of releases Gitea before 1.25.2 mishandles authorization for deletion of releases.

CVE-2025-68944 [MEDIUM] CWE-441 Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.

CVE-2025-68943 [MEDIUM] CWE-497 Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.

CVE-2025-68940 [LOW] CWE-863 Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.

CVE-2025-68946 [MEDIUM] CWE-79 Gitea vulnerable to Cross-site Scripting Gitea vulnerable to Cross-site Scripting In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

CVE-2025-68942 [MEDIUM] CWE-79 Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.

CVE-2019-1010261 [MEDIUM] CWE-79 Gitea XSS Vulnerability Gitea XSS Vulnerability Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later.

CVE-2022-1928 [MEDIUM] CWE-79 Stored Cross-site Scripting in gitea Stored Cross-site Scripting in gitea Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9 via unfiltered pdfs

CVE-2026-20888 Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

CVE-2019-1010314 [MEDIUM] CWE-79 Gitea XSS Vulnerability in Repository Description Gitea XSS Vulnerability in Repository Description Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.