Gitea Gitea Open Source Git Server

• CVE-2026-24059 Medium 6.5 Gitea runner registration-token GET endpoint performs a write under a read-only token scope 0.4%
• CVE-2026-24791 High 8.1 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes 0.4%
• CVE-2026-59765 High 7.5 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata 0.4%
• CVE-2026-59763 Medium 4.3 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads 0.3%
• CVE-2026-58511 Low 2.7 Webhook Authorization Header Returned in Plaintext via API 0.4%
• CVE-2026-58510 Medium 4.3 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private 0.3%
• CVE-2026-58508 Critical 9.1 Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) 0.5%
• CVE-2026-58507 Medium 5.3 Private Repository Existence Disclosure via go-get Meta Endpoint 0.4%
• CVE-2026-58445 Low 2.7 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API 0.4%
• CVE-2026-58444 Medium 4.3 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents 0.4%
• CVE-2026-58443 Critical 9.1 Public-only repository tokens can update private PR head branches 0.6%
• CVE-2026-58442 Medium 6.5 Repository migration SSRF via multi-answer DNS allow-list bypass 0.4%
• CVE-2026-58441 Medium 6.3 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL 0.2%
• CVE-2026-58440 Medium 6.8 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`) 0.5%
• CVE-2026-58439 High 8.1 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag 0.5%
• CVE-2026-58438 High 7.5 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access 0.5%
• CVE-2026-58437 High 7.1 Repository Visibility Manipulation via Git Push Options 0.3%
• CVE-2026-58436 High 7.5 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests 0.6%
• CVE-2026-58435 Medium 5.4 Gitea LFS Deploy-Key Privilege Escalation 0.3%
• CVE-2026-58434 High 7.5 Private Repository Metadata Remains Accessible After Access Revocation 0.5%
• CVE-2026-58433 Critical 9.1 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting 0.5%
• CVE-2026-58432 Medium 5.9 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea 0.4%
• CVE-2026-58431 Medium 4.3 Public-only API token restriction is not enforced on team API routes 0.3%
• CVE-2026-58429 Medium 4.9 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints 0.5%
• CVE-2026-58428 Medium 6.5 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) 0.5%
• CVE-2026-58427 High 7.5 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 0.5%
• CVE-2026-58425 Medium 4.3 OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) 0.3%
• CVE-2026-58420 Medium 4.4 Local File Inclusion via file:// URI in Migration Restore 0.5%
• CVE-2026-58417 High 7.5 REST API exposes organization membership of private organizations to public 0.5%
• CVE-2026-58416 High 7.1 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) 0.3%
• CVE-2026-58314 High 7.7 Two SSRF findings in Gitea 1.26.2 0.4%
• CVE-2026-57897 Medium 6.5 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs 0.4%
• CVE-2026-57894 High 8.5 Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration 0.4%
• CVE-2026-57886 Medium 5.9 Cross-repository issue/comment attachment re-linking can expose private attachment content 0.3%
• CVE-2026-56755 Medium 6.2 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload 0.2%
• CVE-2026-56750 Critical 9.1 Gitea Remember-Me Token Theft Not Invalidating Attacker Session 0.5%
• CVE-2026-56657 Medium 6.2 Gitea SSH Key Parser Denial of Service 0.2%
• CVE-2026-56654 Critical 9.8 Privilege Escalation via Access Token Scope Escalation in API 0.8%
• CVE-2026-56443 Critical 9.6 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 0.5%
• CVE-2026-55987 High 8.1 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) 0.4%
• CVE-2026-55986 Medium 5.4 Email Management API Bypasses ManageCredentials Feature Restrictions 0.3%
• CVE-2026-55984 Low 2.7 Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service 0.5%
• CVE-2026-55982 Critical 9.1 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes 0.5%
• CVE-2026-54481 High 7.5 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) 0.3%
• CVE-2026-50105 Medium 4.3 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) 0.4%
• CVE-2026-42931 Medium 6.5 Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint 0.5%
• CVE-2026-23603 Low 3.1 Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim 0.3%
• CVE-2026-58426 Critical 9.6 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write 0.2%
• CVE-2026-58424 High 8.9 Permanent Fork PR Workflow Approval Gate Bypass 0.3%
• CVE-2026-58423 High 7.7 LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories 0.4%