Gitea Open Source Git Server vulnerabilities

CVE-2026-20896 [CRITICAL] CWE-284 CVE-2026-20896: Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by defaul Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

CVE-2024-6886 [CRITICAL] CWE-79 CVE-2024-6886: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.

CVE-2026-27771 [HIGH] CWE-862 CVE-2026-27771: Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package s Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

CVE-2026-20706 [CRITICAL] CWE-284 CVE-2026-20706: Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope c Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.

CVE-2026-26292 [CRITICAL] CWE-284 CVE-2026-26292: Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror op Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

CVE-2026-27780 [CRITICAL] CWE-863 CVE-2026-27780: Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

CVE-2026-27775 [HIGH] CWE-863 CVE-2026-27775: Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receiv Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

CVE-2026-58422 [CRITICAL] CWE-284 CVE-2026-58422: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

CVE-2026-56654 [CRITICAL] CWE-284 CVE-2026-56654: Privilege Escalation via Access Token Scope Escalation in API Privilege Escalation via Access Token Scope Escalation in API

CVE-2026-22874 [CRITICAL] CWE-918 CVE-2026-22874: Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration a Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

CVE-2026-26232 [CRITICAL] CWE-294 CVE-2026-26232: Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.

CVE-2026-26247 [CRITICAL] CWE-284 CVE-2026-26247: Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during a Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

CVE-2026-28699 [HIGH] CWE-284 CVE-2026-28699: Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

CVE-2026-20897 [CRITICAL] CWE-284 CVE-2026-20897: Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.

CVE-2026-58423 [HIGH] CWE-287 CVE-2026-58423: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repo LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

CVE-2026-22547 [CRITICAL] CWE-20 CVE-2026-22547: Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including l Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.

CVE-2026-20750 [CRITICAL] CWE-284 CVE-2026-20750: Gitea does not properly validate project ownership in organization project operations. A user with p Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.

CVE-2026-55982 [CRITICAL] CWE-200 CVE-2026-55982: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

CVE-2026-58508 [CRITICAL] CWE-284 CVE-2026-58508: Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

CVE-2026-26231 [HIGH] CWE-863 CVE-2026-26231: Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.