Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 12 total.
OIDC userinfo scope bypass in Gitea (CVE-2026-55982)
The OIDC userinfo endpoint (`GET /login/oauth/userinfo`) in Gitea accepts personal access tokens as bearer credentials without enforcing their assigned scopes. A token scoped only to `read:misc` - which is denied acce...
Fixed in 1.27.0
Token scope bypass on archive download endpoint in Gitea (CVE-2026-20706)
The `/archive/*` web endpoint in Gitea does not enforce token scope checks, unlike the `/raw/*`, `/media/*`, and attachment endpoints fixed in PR #37698. A personal access token scoped to any non-repository category (...
Fixed in 1.26.2
Server-side request forgery in Gitea hostmatcher and OpenID sign-in (CVE-2026-58314)
Gitea's IP classifier in the `hostmatcher` module fails to block ten address families including CGNAT (100.64.0.0/10), allowing any authenticated user to direct webhook deliveries or repository migrations to internal ...
Fixed in 1.27.0
Quadratic-time denial of service in Gitea Locale middleware (CVE-2026-58436)
Gitea's Locale middleware passes the raw `Accept-Language` HTTP header to `golang.org/x/text/language.ParseAcceptLanguage` without imposing a size or character-class filter. The existing CVE-2022-32149 guard caps hyph...
Fixed in 1.27.0
Repository visibility manipulation via undocumented git push options in Gitea (CVE-2026-58437)
Gitea's post-receive git hook handler accepts undocumented push options (`repo.private`, `repo.template`) that allow any user with owner or admin-collaborator access to silently toggle a repository's visibility and te...
Fixed in 1.27.0
Account deactivation bypass via OAuth2 sign-in in Gitea (CVE-2026-55987)
Gitea's OAuth2 sign-in callback incorrectly reactivates administrator-deactivated user accounts (`IsActive=false`) when the authentication source does not issue refresh tokens, such as GitHub or any OIDC/OAuth2 source...
Fixed in 1.27.0
Improper certificate validation in Gitea internal API HTTP client (CVE-2026-54481)
Gitea's internal API HTTP client hardcodes `InsecureSkipVerify = true` in its TLS configuration with no operator override, making it the only outbound TLS client in the codebase that cannot be configured to verify pee...
Fixed in 1.27.0
Authorization bypass in Gitea pull request update API endpoint (CVE-2026-58443)
Gitea fails to re-apply a token's public-only restriction when the pull request update endpoint (`POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update`) operates on a private head repository. The publi...
Fixed in 1.27.0
Privilege escalation via Personal Access Token scope bypass in Gitea (CVE-2026-56654)
Gitea's API endpoint for creating Personal Access Tokens (`POST /users/{username}/tokens`) can be accessed using an existing token formatted as `Authorization: Basic <token>:x-oauth-basic`. The Basic auth handler sets...
Fixed in 1.27.0
Denial of service via decompression bomb and O(N²) concatenation in Gitea Debian package parser (CVE-2026-56755)
Gitea's Debian package registry parser decompresses control.tar.gz without any size limit, allowing a crafted 83 MB .deb file to expand to over 16 GB in memory during parsing. A second independent flaw concatenates De...
Fixed in 1.27.0
Remember-Me token theft session persistence in Gitea (CVE-2026-56750)
Gitea's Remember-Me authentication fails to invalidate an attacker's session when a stolen token is detected as compromised via hash mismatch. When the legitimate user's original token triggers a hash mismatch, Gitea ...
Fixed in 1.27.0
SSRF and repository exfiltration via HTTP redirect bypass in Gitea (CVE-2026-57894)
Gitea validates the user-supplied URL before repository migration but passes the original URL to the Git command-line client, which follows HTTP redirects by default. A low-privileged authenticated user can supply a p...
Fixed in 1.27.0