Gitea - vulnerabilities (CVEs)

221 CVEs in 4 products, 78 in the last 30 days, newest from 2026-10-18.

Products

Gitea Open Source Git Server - 97 CVEs
Gitea - 83 CVEs
Act Runner - 1 CVEs
Gitea Runner - 1 CVEs

Newest CVEs of Gitea

CVE-2026-97859 - CVSS 6.5 (medium), 2026-10-18: Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered…
CVE-2026-97204 - CVSS 3.1 (low), 2026-10-18: Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user…
CVE-2026-110494 - CVSS 6.3 (medium), 2026-10-18: Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with…
CVE-2026-110324 - CVSS 6.5 (medium), 2026-10-18: The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user.…
CVE-2026-110311 - CVSS 4.3 (medium), 2026-10-18: Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not…
CVE-2026-109844 - CVSS 4.3 (medium), 2026-10-18: `GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user…
CVE-2026-107686 - CVSS 4.3 (medium), 2026-10-18: The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API…
CVE-2026-107618, 2026-10-18: `POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party…
CVE-2026-105964 - CVSS 6.5 (medium), 2026-10-18: The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the…
CVE-2026-105661 - CVSS 5.3 (medium), 2026-10-18: Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization…
CVE-2026-109553 - CVSS 7.5 (high), 2026-10-18: Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a…
CVE-2026-104627 - CVSS 5.4 (medium), 2026-10-18: The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started…
CVE-2026-78433 - CVSS 5.9 (medium), 2026-10-14: Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the…
CVE-2026-78231 - CVSS 5.3 (medium), 2026-10-14: When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider…
CVE-2026-73814 - CVSS 6.5 (medium), 2026-10-14: Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can…
CVE-2026-73804 - CVSS 8.1 (high), 2026-10-14: Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the…
CVE-2026-73802 - CVSS 8.8 (high), 2026-10-14: Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings,…
CVE-2026-73800 - CVSS 8.8 (high), 2026-10-14: Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author…
CVE-2026-73539 - CVSS 7.5 (high), 2026-10-14: Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style…
CVE-2026-73535 - CVSS 8.8 (high), 2026-10-14: Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an…
CVE-2026-73273 - CVSS 4.3 (medium), 2026-10-14: Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with…
CVE-2026-73135 - CVSS 5.3 (medium), 2026-10-14: Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are…
CVE-2026-73130 - CVSS 4.3 (medium), 2026-10-14: Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into…
CVE-2026-73126 - CVSS 4.3 (medium), 2026-10-14: Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request.…
CVE-2026-71301 - CVSS 4.3 (medium), 2026-10-14: Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with…
CVE-2026-71184 - CVSS 8.8 (high), 2026-10-14: Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the…
CVE-2026-70407 - CVSS 4.3 (medium), 2026-10-14: Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve…
CVE-2026-70406 - CVSS 6.5 (medium), 2026-10-14: Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can…
CVE-2026-70402 - CVSS 5.8 (medium), 2026-10-14: Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as…
CVE-2026-70400 - CVSS 5.4 (medium), 2026-10-14: Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to…