Code.Gitea.Io Gitea vulnerabilities

CVE-2025-68945 [MEDIUM] CWE-359 Gitea: anonymous user can visit private user's project Gitea: anonymous user can visit private user's project In Gitea before 1.21.2, an anonymous user can visit a private user's project.

CVE-2026-20909 [MEDIUM] CWE-284 Gitea exposes tracked time entries without repository authorization Gitea exposes tracked time entries without repository authorization Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.

CVE-2025-68944 [MEDIUM] CWE-441 Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.

CVE-2026-27761 [CRITICAL] CWE-863 Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data ### Summary A Gitea personal access token (PAT) restricted to a non-repository scope (e.g. `read:issue`) can read the commit history of any private repository the token owner can access, via the repository RSS/Atom fe

CVE-2026-59766 [MEDIUM] CWE-863 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` ## Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling

CVE-2026-58507 [MEDIUM] CWE-200 Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint | Field | Value | |-------|-------| | **Affected File** | `routers/web/repo/githttp.go`, `services/context/repo.go` | | **Affected Functions** | `httpBase()`, `EarlyResponseForGoGetMeta()` | | **Affected Lines** | `githttp.go:63–66`, `services/context/repo.go:374–396` | | **Prerequisite** | None — fully unauthenticated |

CVE-2025-68938 [MEDIUM] CWE-863 Gitea mishandles authorization for deletion of releases Gitea mishandles authorization for deletion of releases Gitea before 1.25.2 mishandles authorization for deletion of releases.

CVE-2026-58444 [CRITICAL] CWE-863 Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents ### Summary A personal access token (PAT) or OAuth2 token that does **not** carry the `repository` scope or that is **public-only** is correctly rejected (HTTP 403) by the recen

CVE-2025-68943 [MEDIUM] CWE-497 Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.

CVE-2025-68940 [LOW] CWE-863 Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.

CVE-2025-68942 [MEDIUM] CWE-79 Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.

CVE-2025-68946 [MEDIUM] CWE-79 Gitea vulnerable to Cross-site Scripting Gitea vulnerable to Cross-site Scripting In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

CVE-2026-25714 [MEDIUM] CWE-862 Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw ## Summary Two related issues in the token public-only scope enforcement introduced by PR #32204 (CVE-2025-68941 fix). A public-only scoped API token can access private organization data. ## Issue 1: /user/orgs missing checkTokenPublicOnly() `routers/api/v1/

CVE-2019-1010261 [MEDIUM] CWE-79 Gitea XSS Vulnerability Gitea XSS Vulnerability Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later.

CVE-2022-1928 [MEDIUM] CWE-79 Stored Cross-site Scripting in gitea Stored Cross-site Scripting in gitea Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9 via unfiltered pdfs

CVE-2026-50105 [MEDIUM] CWE-200 Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) ### Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform **no token-scope or public-only enforcement**. A personal access token that is correctly blocked (HTTP 403) from a private repository on `/raw`, `/media`, `/archive`, and

CVE-2026-20888 Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

CVE-2026-58441 [MEDIUM] CWE-918 Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL ### Summary Gitea's `restore-repo` CLI command restores a repository from a dump directory/archive. When parsing `pull_request.yml` from that dump, the `Head.CloneURL` field is used to add a git remote and fetch from it with no validation, because the safety check that's supposed to guard it (`CheckAndEnsureSafePR`)

CVE-2019-1010314 [MEDIUM] CWE-79 Gitea XSS Vulnerability in Repository Description Gitea XSS Vulnerability in Repository Description Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.

CVE-2026-27783 [MEDIUM] CWE-862 Gitea: Missing repository-unit authorization on issue-template API endpoints Gitea: Missing repository-unit authorization on issue-template API endpoints ## Summary Three Gitea API endpoints — `GET /repos/{owner}/{repo}/issue_templates`, `GET /repos/{owner}/{repo}/issue_config` and `GET /repos/{owner}/{repo}/issue_config/validate` — read files from the repository's **Code** default branch (`.gitea/ISSUE_TEMPLATE/*` and `issue_config.yaml`) and return their conte