Filtered by vendor Gitea
Subscribe
Total
81 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-96399 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 7.5 HIGH |
| A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings could make any later rendering of matching content, such as viewing a README, crash the instance for all users. | |||||
| CVE-2026-96400 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 4.3 MEDIUM |
| With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as `169.254.169.254`, even when `ALLOW_LOCALNETWORKS = false`. The local-network block list did not cover these ranges, and a hostname matching the allow list was accepted regardless of its resolved address. A user who can start migrations on such an instance could reach these addresses from the Gitea server; the default empty `ALLOWED_DOMAINS` configuration is not affected. | |||||
| CVE-2026-96404 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 8.1 HIGH |
| When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation. | |||||
| CVE-2026-96580 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 7.5 HIGH |
| Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large number of jobs, consuming server memory and potentially terminating the Gitea process. No runner is required. Static matrices above 256 combinations are now rejected before expansion. | |||||
| CVE-2026-96589 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 4.3 MEDIUM |
| When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The repository owner was not notified. Transfer-granted access is now removed while collaborations that existed before the transfer are preserved. | |||||
| CVE-2026-101023 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 9.1 CRITICAL |
| Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime. | |||||
| CVE-2026-104633 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 6.5 MEDIUM |
| When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service. | |||||
| CVE-2026-105267 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 8.1 HIGH |
| The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion. | |||||
| CVE-2026-105268 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 4.3 MEDIUM |
| The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed. | |||||
| CVE-2025-68946 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 5.4 MEDIUM |
| In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS. | |||||
| CVE-2025-68940 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 3.1 LOW |
| In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request. | |||||
| CVE-2025-68941 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 4.9 MEDIUM |
| Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources. | |||||
| CVE-2025-68945 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 5.8 MEDIUM |
| In Gitea before 1.21.2, an anonymous user can visit a private user's project. | |||||
| CVE-2025-68942 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 5.4 MEDIUM |
| Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text. | |||||
| CVE-2025-68939 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 8.2 HIGH |
| Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API. | |||||
| CVE-2025-68943 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 5.3 MEDIUM |
| Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order. | |||||
| CVE-2025-68944 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 5.0 MEDIUM |
| Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries. | |||||
| CVE-2025-68938 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 4.3 MEDIUM |
| Gitea before 1.25.2 mishandles authorization for deletion of releases. | |||||
| CVE-2026-60004 | 1 Gitea | 1 Gitea | 2026-08-27 | N/A | 9.8 CRITICAL |
| Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. | |||||
| CVE-2026-20912 | 1 Gitea | 1 Gitea | 2026-07-15 | N/A | 9.1 CRITICAL |
| Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users. | |||||