Gitea Open Source Git Server vulnerabilities

CVE-2026-58426 [CRITICAL] CWE-347 CVE-2026-58426: Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

CVE-2026-25718 [CRITICAL] CWE-59 CVE-2026-25718: Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowi Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.

CVE-2026-22555 [HIGH] CWE-284 CVE-2026-22555: Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.

CVE-2026-56750 [CRITICAL] CWE-284 CVE-2026-56750: Gitea Remember-Me Token Theft Not Invalidating Attacker Session Gitea Remember-Me Token Theft Not Invalidating Attacker Session

CVE-2026-20912 [CRITICAL] CWE-284 CVE-2026-20912: Gitea does not properly validate repository ownership when linking attachments to releases. An attac Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.

CVE-2026-28744 [HIGH] CWE-863 CVE-2026-28744: Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer to Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

CVE-2026-57894 [HIGH] CWE-918 CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

CVE-2026-58433 [CRITICAL] CWE-862 CVE-2026-58433: Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

CVE-2026-55987 [HIGH] CWE-863 CVE-2026-55987: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh toke OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

CVE-2026-24791 [HIGH] CWE-863 CVE-2026-24791: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

CVE-2026-58419 [HIGH] CWE-200 CVE-2026-58419: Notification API leaks private issue metadata after access revocation Notification API leaks private issue metadata after access revocation

CVE-2026-58443 [CRITICAL] CWE-863 CVE-2026-58443: Public-only repository tokens can update private PR head branches Public-only repository tokens can update private PR head branches

CVE-2026-25038 [HIGH] CWE-200 CVE-2026-25038: Gitea 1.26.2 allows unauthorized users to access labels of private organizations. Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

CVE-2026-24690 [HIGH] CWE-284 CVE-2026-24690: Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull reque Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.

CVE-2026-27657 [HIGH] CWE-639 CVE-2026-27657: Gitea versions before 1.25.5 allow a user to change another user's primary email address. Gitea versions before 1.25.5 allow a user to change another user's primary email address.

CVE-2026-20736 [HIGH] CWE-284 CVE-2026-20736: Gitea does not properly verify repository context when deleting attachments. A user who previously u Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.

CVE-2026-58438 [HIGH] CWE-862 CVE-2026-58438: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on privat Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

CVE-2026-58439 [HIGH] CWE-284 CVE-2026-58439: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

CVE-2026-27660 [HIGH] CWE-284 CVE-2026-27660: Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the requ Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.

CVE-2026-58417 [HIGH] CWE-284 CVE-2026-58417: REST API exposes organization membership of private organizations to public REST API exposes organization membership of private organizations to public