Code.Gitea.Io Gitea vulnerabilities

CVE-2026-20779 [CRITICAL] CWE-294 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface ### Summary I'm reporting **two related TOTP one-time-use defects** in Gitea that survive the CVE-2021-45331 fix. The 2018 fix (PR #3878) introduced the `TwoFactor.LastUsedPasscode` field and added an in-memory inequality check on the web 2FA login path. That chec

CVE-2026-59765 [MEDIUM] CWE-918 Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata ### Summary Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw `http.Get()` (Go's `DefaultClient`) which completely

CVE-2026-24451 [HIGH] CWE-200 Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private ### Summary The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint continues to synchronize commits from a parent repository after the parent repository has been changed from public to private. A fork created while the parent repository was public can still receive commit

CVE-2026-58421 [HIGH] CWE-284 Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service This issue has been found by a security agent and review by myself. Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to

CVE-2026-28737 [HIGH] CWE-79 Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer ## Summary Me again. Gitea's built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site scripting (XSS) through crafted `.gltf` files. When a glTF file declares an unsupported required extension, Online3DViewer generates an error message containing the extension name and Gitea inserts it into th

CVE-2026-20800 Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

CVE-2026-20883 Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

CVE-2020-13246 Denial of Service in Gitea in code.gitea.io/gitea Denial of Service in Gitea in code.gitea.io/gitea Denial of Service in Gitea in code.gitea.io/gitea

CVE-2021-3382 Buffer Overflow in gitea in code.gitea.io/gitea Buffer Overflow in gitea in code.gitea.io/gitea Buffer Overflow in gitea in code.gitea.io/gitea

CVE-2026-58428 [MEDIUM] CWE-424 Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) ## Summary The web handler `EditReleasePost` (`routers/web/repo/release.go`) reads form fields with prefix `attachment-edit-{uuid}` into a `map[uuid]newName`, passes that map to `release_service.UpdateRelease`, which writes the new name to the database

CVE-2022-38183 [MEDIUM] CWE-732 Gitea allowed assignment of private issues Gitea allowed assignment of private issues In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.

CVE-2026-20904 Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

CVE-2026-58442 [MEDIUM] CWE-200 Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass ### Summary Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if **any** resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later `git clone` operation resol

CVE-2019-1000002 [MEDIUM] CWE-284 Gitea Arbitrary File Delete Vulnerability Gitea Arbitrary File Delete Vulnerability Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any" repository including self-created ones. This vulnerability appears to have been fixed

CVE-2021-28378 [MEDIUM] CWE-79 Cross-site Scripting in Gitea Cross-site Scripting in Gitea Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.

CVE-2022-0905 [HIGH] CWE-862 Gitea Missing Authorization vulnerability Gitea Missing Authorization vulnerability Gitea 1.16.3 and prior is vulnerable to missing authorization. A patch is available as part of the 1.16.4 release.

CVE-2026-58437 [HIGH] CWE-284 Gitea: Repository Visibility Manipulation via Git Push Options Gitea: Repository Visibility Manipulation via Git Push Options ### Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | **Affected File** | `routers/private/hook_post_receive.go` | | **Affected Function** | `HookPostReceive()` | | **Affected Lines** | 173–225 | | **Prerequisite** | Attacker must have owner-level or admin collaborator access to the target reposit

CVE-2026-57897 [MEDIUM] CWE-200 Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs **Author:** Prakhar Porwal **Date:** 2026-05-24 **Target:** Gitea (self-hosted Git service) **Branch tested:** `main` @ `b7e95cc48c` (development build, go1.26.3) **Component:** `routers/api/v1/org/action.go` (org-level Actions API) **OWASP:** API3:2023 Broken Object Property Level Authorization --- ## 1. Summar

CVE-2022-27313 [HIGH] Arbitrary file deletion in gitea Arbitrary file deletion in gitea An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file.

CVE-2026-42931 [MEDIUM] CWE-770 Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint ### Summary An unbounded `io.ReadAll(ctx.Req.Body)` call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory (OOM) kill. With concurrent req