Code.Gitea.Io Gitea vulnerabilities

CVE-2020-13246 Denial of Service in Gitea in code.gitea.io/gitea Denial of Service in Gitea in code.gitea.io/gitea Denial of Service in Gitea in code.gitea.io/gitea

CVE-2021-3382 Buffer Overflow in gitea in code.gitea.io/gitea Buffer Overflow in gitea in code.gitea.io/gitea Buffer Overflow in gitea in code.gitea.io/gitea

CVE-2026-58428 [MEDIUM] CWE-424 Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) ## Summary The web handler `EditReleasePost` (`routers/web/repo/release.go`) reads form fields with prefix `attachment-edit-{uuid}` into a `map[uuid]newName`, passes that map to `release_service.UpdateRelease`, which writes the new name to the database

CVE-2022-38183 [MEDIUM] CWE-732 Gitea allowed assignment of private issues Gitea allowed assignment of private issues In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.

CVE-2026-20904 Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

CVE-2026-58437 [HIGH] CWE-284 Gitea: Repository Visibility Manipulation via Git Push Options Gitea: Repository Visibility Manipulation via Git Push Options ### Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | **Affected File** | `routers/private/hook_post_receive.go` | | **Affected Function** | `HookPostReceive()` | | **Affected Lines** | 173–225 | | **Prerequisite** | Attacker must have owner-level or admin collaborator access to the target reposit

CVE-2021-28378 [MEDIUM] CWE-79 Cross-site Scripting in Gitea Cross-site Scripting in Gitea Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.

CVE-2019-1000002 [MEDIUM] CWE-284 Gitea Arbitrary File Delete Vulnerability Gitea Arbitrary File Delete Vulnerability Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any" repository including self-created ones. This vulnerability appears to have been fixed

CVE-2022-0905 [HIGH] CWE-862 Gitea Missing Authorization vulnerability Gitea Missing Authorization vulnerability Gitea 1.16.3 and prior is vulnerable to missing authorization. A patch is available as part of the 1.16.4 release.

CVE-2026-57897 [MEDIUM] CWE-200 Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs **Author:** Prakhar Porwal **Date:** 2026-05-24 **Target:** Gitea (self-hosted Git service) **Branch tested:** `main` @ `b7e95cc48c` (development build, go1.26.3) **Component:** `routers/api/v1/org/action.go` (org-level Actions API) **OWASP:** API3:2023 Broken Object Property Level Authorization --- ## 1. Summar

CVE-2022-27313 [HIGH] Arbitrary file deletion in gitea Arbitrary file deletion in gitea An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file.

CVE-2026-42931 [MEDIUM] CWE-770 Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint ### Summary An unbounded `io.ReadAll(ctx.Req.Body)` call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory (OOM) kill. With concurrent req

CVE-2026-57886 [MEDIUM] CWE-639 Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content ## Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to a

CVE-2022-38795 [MEDIUM] Gitea erroneous repo clones Gitea erroneous repo clones In Gitea through 1.17.1, repo cloning can occur in the migration function.

CVE-2026-58429 [MEDIUM] CWE-1259 Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints ### Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such t

CVE-2026-25782 [MEDIUM] CWE-639 Gitea tracked-time deletion is not scoped to the requested issue Gitea tracked-time deletion is not scoped to the requested issue Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.

CVE-2021-29134 [MEDIUM] CWE-22 Path Traversal in Gitea Path Traversal in Gitea The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.

CVE-2026-28705 [MEDIUM] CWE-22 Gitea release asset dumps permit path traversal through crafted names Gitea release asset dumps permit path traversal through crafted names Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

CVE-2025-69413 [MEDIUM] CWE-204 Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

CVE-2025-68941 [MEDIUM] CWE-863 Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.