Code.Gitea.Io Gitea vulnerabilities

CVE-2026-57886 [MEDIUM] CWE-639 Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content ## Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to a

CVE-2022-38795 [MEDIUM] Gitea erroneous repo clones Gitea erroneous repo clones In Gitea through 1.17.1, repo cloning can occur in the migration function.

CVE-2025-69413 [MEDIUM] CWE-204 Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

CVE-2026-58429 [MEDIUM] CWE-1259 Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints ### Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such t

CVE-2025-68941 [MEDIUM] CWE-863 Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.

CVE-2021-29134 [MEDIUM] CWE-22 Path Traversal in Gitea Path Traversal in Gitea The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.

CVE-2025-68945 [MEDIUM] CWE-359 Gitea: anonymous user can visit private user's project Gitea: anonymous user can visit private user's project In Gitea before 1.21.2, an anonymous user can visit a private user's project.

CVE-2025-68944 [MEDIUM] CWE-441 Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.

CVE-2025-68938 [MEDIUM] CWE-863 Gitea mishandles authorization for deletion of releases Gitea mishandles authorization for deletion of releases Gitea before 1.25.2 mishandles authorization for deletion of releases.

CVE-2026-27761 [CRITICAL] CWE-863 Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data ### Summary A Gitea personal access token (PAT) restricted to a non-repository scope (e.g. `read:issue`) can read the commit history of any private repository the token owner can access, via the repository RSS/Atom fe

CVE-2025-68943 [MEDIUM] CWE-497 Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.

CVE-2025-68940 [LOW] CWE-863 Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.

CVE-2026-58507 [MEDIUM] CWE-200 Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint | Field | Value | |-------|-------| | **Affected File** | `routers/web/repo/githttp.go`, `services/context/repo.go` | | **Affected Functions** | `httpBase()`, `EarlyResponseForGoGetMeta()` | | **Affected Lines** | `githttp.go:63–66`, `services/context/repo.go:374–396` | | **Prerequisite** | None — fully unauthenticated |

CVE-2025-68946 [MEDIUM] CWE-79 Gitea vulnerable to Cross-site Scripting Gitea vulnerable to Cross-site Scripting In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

CVE-2026-58444 [CRITICAL] CWE-863 Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents ### Summary A personal access token (PAT) or OAuth2 token that does **not** carry the `repository` scope or that is **public-only** is correctly rejected (HTTP 403) by the recen

CVE-2025-68942 [MEDIUM] CWE-79 Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.

CVE-2026-25714 [MEDIUM] CWE-862 Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw ## Summary Two related issues in the token public-only scope enforcement introduced by PR #32204 (CVE-2025-68941 fix). A public-only scoped API token can access private organization data. ## Issue 1: /user/orgs missing checkTokenPublicOnly() `routers/api/v1/

CVE-2019-1010261 [MEDIUM] CWE-79 Gitea XSS Vulnerability Gitea XSS Vulnerability Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later.

CVE-2022-1928 [MEDIUM] CWE-79 Stored Cross-site Scripting in gitea Stored Cross-site Scripting in gitea Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9 via unfiltered pdfs

CVE-2026-20888 Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea