Gitea Open Source Git Server vulnerabilities

CVE-2026-56755 [MEDIUM] CWE-284 CVE-2026-56755: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

CVE-2026-58420 [MEDIUM] CWE-284 CVE-2026-58420: Local File Inclusion via file:// URI in Migration Restore Local File Inclusion via file:// URI in Migration Restore

CVE-2026-25714 [MEDIUM] CWE-862 CVE-2026-25714: Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to t Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.

CVE-2026-58444 [MEDIUM] CWE-863 CVE-2026-58444: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) d Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

CVE-2026-58425 [MEDIUM] CWE-200 CVE-2026-58425: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 vio OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

CVE-2026-58510 [MEDIUM] CWE-200 CVE-2026-58510: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

CVE-2026-59763 [MEDIUM] CWE-284 CVE-2026-59763: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

CVE-2026-0798 [LOW] CWE-284 CVE-2026-0798: Gitea may send release notification emails for private repositories to users whose access has been r Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.

CVE-2026-23603 [LOW] CWE-918 CVE-2026-23603: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

CVE-2026-58511 [LOW] CWE-200 CVE-2026-58511: Webhook Authorization Header Returned in Plaintext via API Webhook Authorization Header Returned in Plaintext via API

CVE-2026-58445 [LOW] CWE-203 CVE-2026-58445: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

CVE-2026-55984 [LOW] CWE-284 CVE-2026-55984: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service