Gitea Open Source Git Server vulnerabilities

CVE-2026-58436 [HIGH] CWE-407 CVE-2026-58436: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

CVE-2026-54481 [HIGH] CWE-295 CVE-2026-54481: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

CVE-2026-58434 [HIGH] CWE-200 CVE-2026-58434: Private Repository Metadata Remains Accessible After Access Revocation Private Repository Metadata Remains Accessible After Access Revocation

CVE-2026-25712 [HIGH] CWE-284 CVE-2026-25712: Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.

CVE-2026-58427 [HIGH] CWE-200 CVE-2026-58427: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

CVE-2026-59765 [HIGH] CWE-918 CVE-2026-59765: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

CVE-2026-24451 [HIGH] CWE-200 CVE-2026-24451: Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public t Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

CVE-2026-28737 [HIGH] CWE-79 CVE-2026-28737: Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsReq Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.

CVE-2026-26307 [HIGH] CWE-400 CVE-2026-26307: Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searc Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.

CVE-2026-58421 [HIGH] CWE-284 CVE-2026-58421: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

CVE-2026-27779 [HIGH] CWE-284 CVE-2026-27779: Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting publ Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.

CVE-2026-28740 [HIGH] CWE-639 CVE-2026-28740: Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source obj Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

CVE-2026-24059 [MEDIUM] CWE-269 CVE-2026-24059: The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-leve The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and registe

CVE-2026-20800 [MEDIUM] CWE-200 CVE-2026-20800: Gitea's notification API does not re-validate repository access permissions when returning notificat Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.

CVE-2026-20779 [HIGH] CWE-294 CVE-2026-20779: Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a vali Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.

CVE-2026-20883 [MEDIUM] CWE-284 CVE-2026-20883: Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.

CVE-2026-20904 [MEDIUM] CWE-284 CVE-2026-20904: Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated use Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.

CVE-2026-58442 [MEDIUM] CWE-200 CVE-2026-58442: Repository migration SSRF via multi-answer DNS allow-list bypass Repository migration SSRF via multi-answer DNS allow-list bypass

CVE-2026-58416 [HIGH] CWE-280 CVE-2026-58416: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

CVE-2026-58437 [HIGH] CWE-284 CVE-2026-58437: Repository Visibility Manipulation via Git Push Options Repository Visibility Manipulation via Git Push Options