Code.Gitea.Io Gitea vulnerabilities

CVE-2026-58443 [CRITICAL] CWE-863 Gitea: Public-only repository tokens can update private PR head branches Gitea: Public-only repository tokens can update private PR head branches ### Summary Gitea allows a `public-only,write:repository` token to update a private pull request head branch through a public base repository route. The vulnerable endpoint is: ```text POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update ``` Gitea checks the token's public-only restriction against t

CVE-2026-25038 [HIGH] CWE-200 Gitea: Unauthorized Access to Labels of Private Organizations Gitea: Unauthorized Access to Labels of Private Organizations ## Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpoints. A user without access to a private organization can retrieve labels belonging to that organization through the Organization Labels API. As a result, label metadata intended to be restricted to organization members may

CVE-2026-24690 [HIGH] CWE-284 Gitea pull request branch permission checks allow unauthorized updates and rebases Gitea pull request branch permission checks allow unauthorized updates and rebases Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.

CVE-2026-58434 [LOW] CWE-200 Gitea: Private Repository Metadata Remains Accessible After Access Revocation Gitea: Private Repository Metadata Remains Accessible After Access Revocation ### Summary A user who previously had access to a private repository can continue to obtain repository metadata through `GET /api/v1/user/starred` after their access to the repository has been revoked. After a collaborator is removed from a private repository, direct access to the repository is correctly denied

CVE-2026-27657 [HIGH] CWE-639 Gitea primary email ownership bypass allows cross-user email changes Gitea primary email ownership bypass allows cross-user email changes Gitea versions before 1.25.5 allow a user to change another user's primary email address.

CVE-2026-20736 [LOW] CWE-284 Gitea has improper access control for uploaded attachments Gitea has improper access control for uploaded attachments Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.

CVE-2022-42968 Gitea vulnerable to Argument Injection in code.gitea.io/gitea Gitea vulnerable to Argument Injection in code.gitea.io/gitea Gitea vulnerable to Argument Injection in code.gitea.io/gitea

CVE-2026-59765 [MEDIUM] CWE-918 Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata ### Summary Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw `http.Get()` (Go's `DefaultClient`) which completely

CVE-2026-27660 [HIGH] CWE-284 Gitea draft releases and attachments are exposed without write permission Gitea draft releases and attachments are exposed without write permission Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.

CVE-2026-20779 [CRITICAL] CWE-294 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface ### Summary I'm reporting **two related TOTP one-time-use defects** in Gitea that survive the CVE-2021-45331 fix. The 2018 fix (PR #3878) introduced the `TwoFactor.LastUsedPasscode` field and added an in-memory inequality check on the web 2FA login path. That chec

CVE-2026-25712 [HIGH] CWE-284 Gitea organization permission APIs expose hidden membership and private organization data Gitea organization permission APIs expose hidden membership and private organization data Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.

CVE-2026-54481 [HIGH] CWE-295 Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override Summary Gitea's internal API HTTP client (modules/private/internal.go) hardcodes TLSClientConfig.InsecureSkipVerify = true with no configuration override. It is the only outbound TLS client in the codebase that cannot be made to verify its peer's certificate — webhook, migrations, MinIO,

CVE-2026-24451 [HIGH] CWE-200 Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private ### Summary The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint continues to synchronize commits from a parent repository after the parent repository has been changed from public to private. A fork created while the parent repository was public can still receive commit

CVE-2026-26307 [HIGH] CWE-400 Gitea git grep searches allow server resource exhaustion Gitea git grep searches allow server resource exhaustion Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.

CVE-2026-58421 [HIGH] CWE-284 Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service This issue has been found by a security agent and review by myself. Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to

CVE-2026-27779 [HIGH] CWE-284 Gitea forwarded-proto validation allows canonical URL spoofing Gitea forwarded-proto validation allows canonical URL spoofing Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.

CVE-2026-28737 [HIGH] CWE-79 Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer ## Summary Me again. Gitea's built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site scripting (XSS) through crafted `.gltf` files. When a glTF file declares an unsupported required extension, Online3DViewer generates an error message containing the extension name and Gitea inserts it into th

CVE-2026-20800 Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

CVE-2026-20883 Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

CVE-2026-58442 [MEDIUM] CWE-200 Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass ### Summary Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if **any** resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later `git clone` operation resol