Code.Gitea.Io Gitea vulnerabilities

CVE-2026-50105 [MEDIUM] CWE-200 Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) ### Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform **no token-scope or public-only enforcement**. A personal access token that is correctly blocked (HTTP 403) from a private repository on `/raw`, `/media`, `/archive`, and

CVE-2026-58441 [MEDIUM] CWE-918 Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL ### Summary Gitea's `restore-repo` CLI command restores a repository from a dump directory/archive. When parsing `pull_request.yml` from that dump, the `Head.CloneURL` field is used to add a git remote and fetch from it with no validation, because the safety check that's supposed to guard it (`CheckAndEnsureSafePR`)

CVE-2019-1010314 [MEDIUM] CWE-79 Gitea XSS Vulnerability in Repository Description Gitea XSS Vulnerability in Repository Description Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.

CVE-2026-27783 [MEDIUM] CWE-862 Gitea: Missing repository-unit authorization on issue-template API endpoints Gitea: Missing repository-unit authorization on issue-template API endpoints ## Summary Three Gitea API endpoints — `GET /repos/{owner}/{repo}/issue_templates`, `GET /repos/{owner}/{repo}/issue_config` and `GET /repos/{owner}/{repo}/issue_config/validate` — read files from the repository's **Code** default branch (`.gitea/ISSUE_TEMPLATE/*` and `issue_config.yaml`) and return their conte

CVE-2026-56755 [HIGH] CWE-409 Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload Gitea's Debian package registry parser contains an unbounded decompression vulnerability in [ParseControlFile](https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/modules/packages/debian/metadata.go#L140). When processing an

CVE-2026-58425 [MEDIUM] CWE-200 Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) ## Live reproduction against Gitea 1.26.1 Setup: Gitea 1.26.1 docker stack with two users (`admin` and `victim`) and two OAuth applications owned by different users: ``` Client A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e owner=admin Cli

CVE-2026-58510 [MEDIUM] CWE-200 Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private ## Summary GHSA-8fwc-qjw5-rvgp ("Gitea may send release notification emails for private repositories to users whose access has been revoked", fix in PR #36319 / commit 8a98ac22) added

CVE-2026-59763 [MEDIUM] CWE-770 Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads ## Summary Hello Gitea Security Team, Thank you for your continued work on Gitea. I would like to responsibly report a potential availability-impact issue that I observed in Gitea’s Arch package registry implementation. During local testing, I noticed that Git

CVE-2023-3515 [LOW] CWE-601 code.gitea.io/gitea Open Redirect vulnerability code.gitea.io/gitea Open Redirect vulnerability Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. This is most likely a post-auth redirect plus it is a POST based request scenario, so less likely that can be exploited or chained with other bugs that can cause phishing or credential theft.

CVE-2026-0798 [LOW] CWE-284 Gitea may send release notification emails for private repositories to users whose access has been revoked Gitea may send release notification emails for private repositories to users whose access has been revoked Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, poten

CVE-2026-23603 [LOW] CWE-918 Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim ### Summary When `[oauth2_client] UPDATE_AVATAR = true` is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go's default HTTP client. The URL comes from the user's OAuth/OIDC avatar value, commonly the OIDC `picture` claim. The affected code path calls `http.Get(u

CVE-2026-58511 [LOW] CWE-200 Gitea: Webhook Authorization Header Returned in Plaintext via API Gitea: Webhook Authorization Header Returned in Plaintext via API ## Summary The `ToHook()` function in `services/webhook/general.go` decrypts the webhook's `HeaderAuthorizationEncrypted` field and returns the plaintext authorization header in the API response. Any repository admin can read the full plaintext value of webhook authorization headers (Bearer tokens, Basic auth credentials, API keys) set

CVE-2026-58445 [LOW] CWE-203 Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API ## Summary The API endpoint `DELETE /repos/{owner}/{repo}/issues/{index}/labels/{id}` loads the label by ID with a **global, unscoped** lookup and never verifies the label belongs to the URL's repository (or its owning organization). Because the response status differs by whether the label ID exi

CVE-2026-55984 [LOW] CWE-476 Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service ### Summary The AddTime API handler continues execution after an error returned by `GetUserByName()`. When a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a ru

CVE-2026-59766 [MEDIUM] CWE-863 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` ## Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling

CVE-2026-58418 [MEDIUM] CWE-918 Gitea: SSRF via HTTP Redirect in Repository Migration Gitea: SSRF via HTTP Redirect in Repository Migration ## Summary Gitea 1.25.4 validates the initial URL provided to the repository migration endpoint (`POST /api/v1/repos/migrate`) and correctly blocks requests to internal addresses like `127.0.0.1` or RFC1918 ranges. However, if the initial URL points to an attacker-controlled server that responds with an HTTP 302 redirect to an internal address, Gitea follo

CVE-2026-58424 [HIGH] CWE-285 Gitea: Permanent Fork PR Workflow Approval Gate Bypass Gitea: Permanent Fork PR Workflow Approval Gate Bypass | Field | Value | |-------|-------| | **Identifier (researcher-assigned)** | GITEA-2026-004 | | **Product** | Gitea (self-hosted Git service) | | **Component** | Gitea Actions — fork pull request approval gate | | **Affected versions** | All Gitea releases **`v1.20.0` and later**, including the latest `main` (`1.27.0+dev-289-gb7e95cc48c`). The buggy logic w

CVE-2026-58314 [HIGH] CWE-918 Gitea: Two SSRF findings Gitea: Two SSRF findings | --- | --- | | Versions tested | `gitea/gitea:1.26.2` (digest `sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031`); `gitea/gitea:latest` resolves to the same digest at time of writing | | Source review | `git checkout v1.26.2` (commit `2c749ce`) | | Reproduction | `bash run_poc.sh` (single shot: brings up containers, runs three PoCs, prints captured evidence, tears down on exit) | | Files touc

CVE-2026-56657 [MEDIUM] CWE-400 Gitea SSH Key Parser Denial of Service Gitea SSH Key Parser Denial of Service Gitea's SSH key ingestion endpoint accepts keys in RFC 4716 (SSH2) format and normalises them before storage. The normalisation function contains an O(N²) string concatenation loop with no input size limit, meaning a single malicious key submission can force the server to perform an amount of work that grows quadratically with the size of the input. Any authenticated user can exploit th

CVE-2026-58435 [MEDIUM] CWE-266 Gitea LFS Deploy-Key Privilege Escalation Gitea LFS Deploy-Key Privilege Escalation ## Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location | `services/lfs/server.go:268`, `routers/private/serv.go:275` | | Affected Versions | 1.25.5 | ## Exe