CVE-2026-24059Gitea runner registration-token GET endpoint performs a write under a read-only token scope Exploitation status Not known exploited Fix Published 08/13/2026 Severity Medium CVE-2026-24791Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes Exploitation status Public exploit Fix Published 08/13/2026 Severity High CVE-2026-59765SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata Exploitation status Public exploit Fix Published 08/13/2026 Severity High CVE-2026-59763Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58511Webhook Authorization Header Returned in Plaintext via API Exploitation status Public exploit Fix Published 08/13/2026 Severity Low CVE-2026-58510GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58508Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) Exploitation status Not known exploited Fix Published 08/13/2026 Severity Critical CVE-2026-58507Private Repository Existence Disclosure via go-get Meta Endpoint Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58445Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API Exploitation status Public exploit Fix Published 08/13/2026 Severity Low CVE-2026-58444Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58443Public-only repository tokens can update private PR head branches Exploitation status Public exploit Fix Published 08/13/2026 Severity Critical CVE-2026-58442Repository migration SSRF via multi-answer DNS allow-list bypass Exploitation status Not known exploited Fix Published 08/13/2026 Severity Medium CVE-2026-58441SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58440Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`) Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58439Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag Exploitation status Public exploit Fix Published 08/13/2026 Severity High CVE-2026-58438Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access Exploitation status Public exploit Fix Published 08/13/2026 Severity High CVE-2026-58437Repository Visibility Manipulation via Git Push Options Exploitation status Public exploit Fix Published 08/13/2026 Severity High CVE-2026-58436ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests Exploitation status Public exploit Fix Published 08/13/2026 Severity High CVE-2026-58435Gitea LFS Deploy-Key Privilege Escalation Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58434Private Repository Metadata Remains Accessible After Access Revocation Exploitation status Public exploit Fix Not confirmed Published 08/13/2026 Severity High CVE-2026-58433Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting Exploitation status Public exploit Fix Published 08/13/2026 Severity Critical CVE-2026-58432Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58431Public-only API token restriction is not enforced on team API routes Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58429Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58428Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58427Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 Exploitation status Not known exploited Fix Published 08/13/2026 Severity High CVE-2026-58425OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58420Local File Inclusion via file:// URI in Migration Restore Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-58417REST API exposes organization membership of private organizations to public Exploitation status Public exploit Fix Published 08/13/2026 Severity High CVE-2026-58416Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) Exploitation status Not known exploited Fix Published 08/13/2026 Severity High CVE-2026-58314Two SSRF findings in Gitea 1.26.2 Exploitation status Public exploit Fix Published 08/13/2026 Severity High CVE-2026-57897Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-57894Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration Exploitation status Public exploit Fix Published 08/13/2026 Severity High CVE-2026-57886Cross-repository issue/comment attachment re-linking can expose private attachment content Exploitation status Not known exploited Fix Published 08/13/2026 Severity Medium CVE-2026-56755Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-56750Gitea Remember-Me Token Theft Not Invalidating Attacker Session Exploitation status Not known exploited Fix Published 08/13/2026 Severity Critical CVE-2026-56657Gitea SSH Key Parser Denial of Service Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-56654Privilege Escalation via Access Token Scope Escalation in API Exploitation status Public exploit Fix Published 08/13/2026 Severity Critical CVE-2026-56443Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 Exploitation status Public exploit Fix Published 08/13/2026 Severity Critical CVE-2026-55987OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) Exploitation status Public exploit Fix Published 08/13/2026 Severity High CVE-2026-55986Email Management API Bypasses ManageCredentials Feature Restrictions Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-55984Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service Exploitation status Public exploit Fix Published 08/13/2026 Severity Low CVE-2026-55982OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes Exploitation status Public exploit Fix Not confirmed Published 08/13/2026 Severity Critical CVE-2026-54481Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) Exploitation status Public exploit Fix Published 08/13/2026 Severity High CVE-2026-50105RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-42931Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint Exploitation status Public exploit Fix Published 08/13/2026 Severity Medium CVE-2026-23603Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim Exploitation status Public exploit Fix Published 08/13/2026 Severity Low CVE-2026-58426Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write Exploitation status Public exploit Fix Published 07/03/2026 Severity Critical CVE-2026-58424Permanent Fork PR Workflow Approval Gate Bypass Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-58423LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-58422Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts Exploitation status Public exploit Fix Published 07/03/2026 Severity Critical CVE-2026-58421Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-58419Notification API leaks private issue metadata after access revocation Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-58418SSRF via HTTP Redirect in Repository Migration Exploitation status Public exploit Fix Published 07/03/2026 Severity Medium CVE-2026-28744Gitea Git smart HTTP bypasses repository token scopes for bearer tokens Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-28740Gitea LFS object reuse bypasses Code-unit authorization Exploitation status Not known exploited Fix Published 07/03/2026 Severity High CVE-2026-28737Gitea 3D file viewer allows stored XSS through glTF extensionsRequired Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-28705Gitea repository dumps write release assets using unsafe path names Exploitation status Not known exploited Fix Published 07/03/2026 Severity Medium CVE-2026-28699Gitea Basic Auth bypasses OAuth2 access token scopes Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-27783Gitea issue-template APIs bypass repository unit authorization Exploitation status Public exploit Fix Published 07/03/2026 Severity Medium CVE-2026-27780Gitea pre-receive hook can miss branch-protection checks after scanner errors Exploitation status Not known exploited Fix Published 07/03/2026 Severity Critical CVE-2026-27779Gitea forwarded-proto handling allows public URL spoofing Exploitation status Not known exploited Fix Published 07/03/2026 Severity High CVE-2026-27775Gitea pre-receive hook permission cache allows full repository write access Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-27771Gitea Composer package source links use insufficient permission checks Exploitation status Not known exploited Fix Published 07/03/2026 Severity High CVE-2026-27761Gitea repository feeds bypass API token scope enforcement Exploitation status Public exploit Fix Published 07/03/2026 Severity Medium CVE-2026-27660Gitea draft releases use insufficient permission checks Exploitation status Not known exploited Fix Published 07/03/2026 Severity High CVE-2026-27657Gitea email settings allow changing another user's primary email address Exploitation status Not known exploited Fix Published 07/03/2026 Severity High CVE-2026-26307Gitea git grep search lacks a timeout Exploitation status Not known exploited Fix Published 07/03/2026 Severity High CVE-2026-26292Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions Exploitation status Not known exploited Fix Published 07/03/2026 Severity Critical CVE-2026-26247Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange Exploitation status Not known exploited Fix Published 07/03/2026 Severity Critical CVE-2026-26232Gitea OAuth2 authorization codes lack expiry and reuse enforcement Exploitation status Not known exploited Fix Published 07/03/2026 Severity Critical CVE-2026-26231Gitea maintainer-edit permissions allow unauthorized commits to readable repositories Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-25782Gitea tracked-time deletion can target entries from another issue Exploitation status Not known exploited Fix Published 07/03/2026 Severity Medium CVE-2026-25779Gitea redirect handling permits open redirects through backslash paths Exploitation status Public exploit Fix Published 07/03/2026 Severity Medium CVE-2026-25718Gitea template repository generation mishandles symlinked paths Exploitation status Not known exploited Fix Published 07/03/2026 Severity Critical CVE-2026-25714Gitea user organization API bypasses public-only token filtering Exploitation status Public exploit Fix Published 07/03/2026 Severity Medium CVE-2026-25712Gitea organization permission APIs expose private visibility information Exploitation status Not known exploited Fix Published 07/03/2026 Severity High CVE-2026-25038Gitea private organization labels are visible to unauthorized users Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-24690Gitea pull-request branch updates use insufficient permission checks Exploitation status Not known exploited Fix Published 07/03/2026 Severity High CVE-2026-24451Gitea fork synchronization can expose private parent repository data Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-22874Gitea webhook and migration allow-list filtering permits SSRF Exploitation status Public exploit Fix Published 07/03/2026 Severity Critical CVE-2026-22555Gitea organization forks can expose organization secrets without create permission Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-22547Gitea repository creation accepts invalid field values Exploitation status Not known exploited Fix Published 07/03/2026 Severity Critical CVE-2026-20909Gitea tracked-time list endpoint has insufficient permission checks Exploitation status Not known exploited Fix Published 07/03/2026 Severity Medium CVE-2026-20896Gitea Docker image trusts spoofable reverse-proxy headers by default Exploitation status Public exploit Fix Published 07/03/2026 Severity Critical CVE-2026-20779Gitea TOTP single-use enforcement defect allows OTP replay Exploitation status Public exploit Fix Published 07/03/2026 Severity High CVE-2026-20706Gitea repository archive downloads bypass token scope checks Exploitation status Public exploit Fix Published 07/03/2026 Severity Critical CVE-2026-20912Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure Exploitation status Not known exploited Fix Published 01/22/2026 Severity Critical CVE-2026-20904Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes Exploitation status Not known exploited Fix Published 01/22/2026 Severity Medium CVE-2026-20897Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) Exploitation status Not known exploited Fix Published 01/22/2026 Severity Critical CVE-2026-20888Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass) Exploitation status Not known exploited Fix Published 01/22/2026 Severity Medium CVE-2026-20883Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure Exploitation status Not known exploited Fix Published 01/22/2026 Severity Medium CVE-2026-20800Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation Exploitation status Not known exploited Fix Published 01/22/2026 Severity Medium CVE-2026-20750Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR) Exploitation status Not known exploited Fix Published 01/22/2026 Severity Critical CVE-2026-20736Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check Exploitation status Not known exploited Fix Published 01/22/2026 Severity High CVE-2026-0798Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation Exploitation status Not known exploited Fix Published 01/22/2026 Severity Low CVE-2024-6886Inproper Sanitation of field leading to stored XSS Exploitation status Not known exploited Fix Not confirmed Published 08/06/2024 Severity Critical 
