https://vulnogram.org/ Most recent CVEs assigned by Gitea Limited (gitea). https://vulnogram.org/seaview/icons/gitea.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-97859 https://vulnogram.org/CVE-2026-97859 Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target u… Medium Sun, 18 Oct 2026 19:01:04 GMT https://vulnogram.org/CVE-2026-97204 https://vulnogram.org/CVE-2026-97204 Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an org… Low Sun, 18 Oct 2026 19:00:50 GMT https://vulnogram.org/CVE-2026-110494 https://vulnogram.org/CVE-2026-110494 Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that rep… Medium Sun, 18 Oct 2026 18:57:26 GMT https://vulnogram.org/CVE-2026-110324 https://vulnogram.org/CVE-2026-110324 The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and descriptio… Medium Sun, 18 Oct 2026 18:57:20 GMT https://vulnogram.org/CVE-2026-110311 https://vulnogram.org/CVE-2026-110311 Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore receive… Medium Sun, 18 Oct 2026 18:57:14 GMT https://vulnogram.org/CVE-2026-109844 https://vulnogram.org/CVE-2026-109844 `GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through… Medium Sun, 18 Oct 2026 18:57:08 GMT https://vulnogram.org/CVE-2026-107686 https://vulnogram.org/CVE-2026-107686 The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a l… Medium Sun, 18 Oct 2026 18:56:59 GMT https://vulnogram.org/CVE-2026-107618 https://vulnogram.org/CVE-2026-107618 `POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the… Sun, 18 Oct 2026 18:56:53 GMT https://vulnogram.org/CVE-2026-105964 https://vulnogram.org/CVE-2026-105964 The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust th… Medium Sun, 18 Oct 2026 18:56:47 GMT https://vulnogram.org/CVE-2026-105661 https://vulnogram.org/CVE-2026-105661 Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answer… Medium Network Exploitable Sun, 18 Oct 2026 18:56:41 GMT https://vulnogram.org/CVE-2026-109553 https://vulnogram.org/CVE-2026-109553 Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_… High Sun, 18 Oct 2026 18:51:31 GMT https://vulnogram.org/CVE-2026-104627 https://vulnogram.org/CVE-2026-104627 The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID… Medium Network Exploitable Sun, 18 Oct 2026 18:51:06 GMT https://vulnogram.org/CVE-2026-78433 https://vulnogram.org/CVE-2026-78433 Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private a… Medium Network Exploitable Wed, 14 Oct 2026 14:38:17 GMT https://vulnogram.org/CVE-2026-78231 https://vulnogram.org/CVE-2026-78231 When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, a… Medium Network Exploitable Wed, 14 Oct 2026 14:38:10 GMT https://vulnogram.org/CVE-2026-73814 https://vulnogram.org/CVE-2026-73814 Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operati… Medium Wed, 14 Oct 2026 14:38:05 GMT https://vulnogram.org/CVE-2026-73804 https://vulnogram.org/CVE-2026-73804 Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token sc… High Wed, 14 Oct 2026 14:38:00 GMT https://vulnogram.org/CVE-2026-73802 https://vulnogram.org/CVE-2026-73802 Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privilege… High Wed, 14 Oct 2026 14:37:55 GMT https://vulnogram.org/CVE-2026-73800 https://vulnogram.org/CVE-2026-73800 Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the rep… High Wed, 14 Oct 2026 14:37:49 GMT https://vulnogram.org/CVE-2026-73539 https://vulnogram.org/CVE-2026-73539 Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including op… High Wed, 14 Oct 2026 14:37:44 GMT https://vulnogram.org/CVE-2026-73535 https://vulnogram.org/CVE-2026-73535 Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password… High Wed, 14 Oct 2026 14:37:39 GMT https://vulnogram.org/CVE-2026-73273 https://vulnogram.org/CVE-2026-73273 Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate ch… Medium Wed, 14 Oct 2026 14:37:30 GMT https://vulnogram.org/CVE-2026-73135 https://vulnogram.org/CVE-2026-73135 Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes c… Medium Network Exploitable Wed, 14 Oct 2026 14:37:25 GMT https://vulnogram.org/CVE-2026-73130 https://vulnogram.org/CVE-2026-73130 Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory… Medium Wed, 14 Oct 2026 14:37:20 GMT https://vulnogram.org/CVE-2026-73126 https://vulnogram.org/CVE-2026-73126 Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the late… Medium Wed, 14 Oct 2026 14:37:15 GMT https://vulnogram.org/CVE-2026-71301 https://vulnogram.org/CVE-2026-71301 Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a private repository can submit a markup preview request and retrieve a pri… Medium Wed, 14 Oct 2026 14:37:10 GMT https://vulnogram.org/CVE-2026-71184 https://vulnogram.org/CVE-2026-71184 Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can co… High Wed, 14 Oct 2026 14:37:05 GMT https://vulnogram.org/CVE-2026-70407 https://vulnogram.org/CVE-2026-70407 Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can incl… Medium Wed, 14 Oct 2026 14:36:59 GMT https://vulnogram.org/CVE-2026-70406 https://vulnogram.org/CVE-2026-70406 Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve co… Medium Wed, 14 Oct 2026 14:36:53 GMT https://vulnogram.org/CVE-2026-70402 https://vulnogram.org/CVE-2026-70402 Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or a… Medium Wed, 14 Oct 2026 14:36:46 GMT https://vulnogram.org/CVE-2026-70400 https://vulnogram.org/CVE-2026-70400 Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the auth… Medium Wed, 14 Oct 2026 14:36:41 GMT https://vulnogram.org/CVE-2026-70396 https://vulnogram.org/CVE-2026-70396 Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can th… Medium Wed, 14 Oct 2026 14:36:36 GMT https://vulnogram.org/CVE-2026-68964 https://vulnogram.org/CVE-2026-68964 Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibil… Medium Wed, 14 Oct 2026 14:36:28 GMT https://vulnogram.org/CVE-2026-68957 https://vulnogram.org/CVE-2026-68957 Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's… Medium Wed, 14 Oct 2026 14:36:22 GMT https://vulnogram.org/CVE-2026-67577 https://vulnogram.org/CVE-2026-67577 Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corre… Medium Wed, 14 Oct 2026 14:36:16 GMT https://vulnogram.org/CVE-2026-66877 https://vulnogram.org/CVE-2026-66877 Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause i… High Wed, 14 Oct 2026 14:36:11 GMT https://vulnogram.org/CVE-2026-66874 https://vulnogram.org/CVE-2026-66874 For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required sta… Medium Wed, 14 Oct 2026 14:36:06 GMT https://vulnogram.org/CVE-2026-66853 https://vulnogram.org/CVE-2026-66853 Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's pub… Medium Wed, 14 Oct 2026 14:36:01 GMT https://vulnogram.org/CVE-2026-66849 https://vulnogram.org/CVE-2026-66849 Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should… Medium Wed, 14 Oct 2026 14:35:55 GMT https://vulnogram.org/CVE-2026-63792 https://vulnogram.org/CVE-2026-63792 Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository t… Medium Wed, 14 Oct 2026 14:29:01 GMT https://vulnogram.org/CVE-2026-63021 https://vulnogram.org/CVE-2026-63021 Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed arch… Medium Wed, 14 Oct 2026 14:28:56 GMT https://vulnogram.org/CVE-2026-62925 https://vulnogram.org/CVE-2026-62925 Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly c… Medium Wed, 14 Oct 2026 14:28:51 GMT https://vulnogram.org/CVE-2026-60021 https://vulnogram.org/CVE-2026-60021 Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the… Medium Wed, 14 Oct 2026 14:28:46 GMT https://vulnogram.org/CVE-2026-60018 https://vulnogram.org/CVE-2026-60018 Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneD… Medium Wed, 14 Oct 2026 14:28:41 GMT https://vulnogram.org/CVE-2026-60010 https://vulnogram.org/CVE-2026-60010 Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's r… Medium Wed, 14 Oct 2026 14:28:36 GMT https://vulnogram.org/CVE-2026-60008 https://vulnogram.org/CVE-2026-60008 Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can su… Low Wed, 14 Oct 2026 14:28:31 GMT https://vulnogram.org/CVE-2026-59774 https://vulnogram.org/CVE-2026-59774 Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the… Critical Network Exploitable Wed, 14 Oct 2026 14:28:25 GMT https://vulnogram.org/CVE-2026-59766 https://vulnogram.org/CVE-2026-59766 Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve reposi… Medium Wed, 14 Oct 2026 14:28:20 GMT https://vulnogram.org/CVE-2026-25946 https://vulnogram.org/CVE-2026-25946 When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopbac… Medium Network Exploitable Wed, 14 Oct 2026 14:28:15 GMT https://vulnogram.org/CVE-2026-97626 https://vulnogram.org/CVE-2026-97626 Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and… Medium Tue, 06 Oct 2026 21:36:48 GMT https://vulnogram.org/CVE-2026-96594 https://vulnogram.org/CVE-2026-96594 The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML f… Medium Network Exploitable Tue, 06 Oct 2026 21:36:38 GMT