Code.Gitea.Io Gitea vulnerabilities

CVE-2026-55982 [MEDIUM] CWE-200 Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes ### Summary The OIDC userinfo endpoint (`GET /login/oauth/userinfo`) accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims. A personal access token scoped only to `read:misc` can successfully retrieve user information from

CVE-2026-26231 [HIGH] CWE-863 Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo ## Summary Any authenticated low-privilege user with read access to a repository can push arbitrary commits directly to that repository, bypassing all write-access checks. ## Vulnerability Gitea's "Allow edits from maintainers" PR option can

CVE-2026-22555 [HIGH] CWE-863 Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration ## Summary The API endpoint `POST /api/v1/repos/{owner}/{repo}/forks` only checks `IsOrgMember()` when a user forks a repository into an organization, but does not check `CanCreateOrgRepo()`. The web UI fork handler correctly checks both. This allows a read-only organization member — in a team with `can_create_

CVE-2026-58426 [CRITICAL] CWE-347 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write ### Summary Gitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the original HMAC signature. An attacker with permissio

CVE-2026-56750 [CRITICAL] CWE-613 Gitea Remember-Me Token Theft Not Invalidating Attacker Session Gitea Remember-Me Token Theft Not Invalidating Attacker Session The vulnerability is in the Remember-Me (gitea_incredible) token validation logic, specifically when handling a compromised token (hash mismatch). The vulnerable function is this one: https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/auth_token.go#L33-L64 ### Affected Endpoint POST `/user/

CVE-2026-58419 [MEDIUM] CWE-200 Gitea: Notification API leaks private issue metadata after access revocation Gitea: Notification API leaks private issue metadata after access revocation # Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation, the `subject

CVE-2026-24791 [MEDIUM] CWE-863 Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes ## Summary Many authenticated self routes under `/api/v1/user/...` do not enforce the `public-only` token restriction. As a result, a token or OAuth grant marked `public-only`, but otherwise carrying the route-required read/write scope category, can access or modify private accou

CVE-2026-28744 [HIGH] CWE-863 Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens ### Summary Gitea v1.26.1 enforces repository-scoped access-token permissions on repository operations. In the Git Smart HTTP path, however, this check runs only when the token is presented via HTTP Basic authentication — `CheckRepoScopedToken()` returns early unless `ctx.IsBasicAuth` is true — so the same token sent as `Author

CVE-2026-20912 Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

CVE-2026-57894 [HIGH] CWE-918 Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration # Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration ## Summary Gitea validates the user-supplied repository migration U

CVE-2021-45330 [CRITICAL] CWE-269 Improper Privilege Management in Gitea Improper Privilege Management in Gitea An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse.

CVE-2026-58436 [HIGH] CWE-1333 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests ### Summary The Locale middleware that runs in front of every unauthenticated request calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing a size or shape filter. The underlying parser has quadratic-time behaviour on lon

CVE-2026-55987 [HIGH] CWE-863 Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) ## Description Gitea's OAuth2 sign-in callback reactivates a deactivated user account (`IsActive=false`) when the user signs in through an authentication source that does not issue refresh token

CVE-2026-56443 [MEDIUM] CWE-863 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 ## Summary After [PR #37118](https://github.com/go-gitea/gitea/pull/37118) / **CVE-2026-25714** (`fix: Unify public-only token filtering in API queries and repo access chec

CVE-2026-58443 [CRITICAL] CWE-863 Gitea: Public-only repository tokens can update private PR head branches Gitea: Public-only repository tokens can update private PR head branches ### Summary Gitea allows a `public-only,write:repository` token to update a private pull request head branch through a public base repository route. The vulnerable endpoint is: ```text POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update ``` Gitea checks the token's public-only restriction against t

CVE-2026-25038 [HIGH] CWE-200 Gitea: Unauthorized Access to Labels of Private Organizations Gitea: Unauthorized Access to Labels of Private Organizations ## Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpoints. A user without access to a private organization can retrieve labels belonging to that organization through the Organization Labels API. As a result, label metadata intended to be restricted to organization members may

CVE-2026-20736 [LOW] CWE-284 Gitea has improper access control for uploaded attachments Gitea has improper access control for uploaded attachments Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.

CVE-2026-54481 [HIGH] CWE-295 Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override Summary Gitea's internal API HTTP client (modules/private/internal.go) hardcodes TLSClientConfig.InsecureSkipVerify = true with no configuration override. It is the only outbound TLS client in the codebase that cannot be made to verify its peer's certificate — webhook, migrations, MinIO,

CVE-2026-58434 [LOW] CWE-200 Gitea: Private Repository Metadata Remains Accessible After Access Revocation Gitea: Private Repository Metadata Remains Accessible After Access Revocation ### Summary A user who previously had access to a private repository can continue to obtain repository metadata through `GET /api/v1/user/starred` after their access to the repository has been revoked. After a collaborator is removed from a private repository, direct access to the repository is correctly denied

CVE-2022-42968 Gitea vulnerable to Argument Injection in code.gitea.io/gitea Gitea vulnerable to Argument Injection in code.gitea.io/gitea Gitea vulnerable to Argument Injection in code.gitea.io/gitea