Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 6 total.
Server-side request forgery in Gitea hostmatcher and OpenID sign-in (CVE-2026-58314)
Gitea's IP classifier in the `hostmatcher` module fails to block ten address families including CGNAT (100.64.0.0/10), allowing any authenticated user to direct webhook deliveries or repository migrations to internal ...
Fixed in 1.27.0
Quadratic-time denial of service in Gitea Locale middleware (CVE-2026-58436)
Gitea's Locale middleware passes the raw `Accept-Language` HTTP header to `golang.org/x/text/language.ParseAcceptLanguage` without imposing a size or character-class filter. The existing CVE-2022-32149 guard caps hyph...
Fixed in 1.27.0
Repository visibility manipulation via undocumented git push options in Gitea (CVE-2026-58437)
Gitea's post-receive git hook handler accepts undocumented push options (`repo.private`, `repo.template`) that allow any user with owner or admin-collaborator access to silently toggle a repository's visibility and te...
Fixed in 1.27.0
Account deactivation bypass via OAuth2 sign-in in Gitea (CVE-2026-55987)
Gitea's OAuth2 sign-in callback incorrectly reactivates administrator-deactivated user accounts (`IsActive=false`) when the authentication source does not issue refresh tokens, such as GitHub or any OIDC/OAuth2 source...
Fixed in 1.27.0
Improper certificate validation in Gitea internal API HTTP client (CVE-2026-54481)
Gitea's internal API HTTP client hardcodes `InsecureSkipVerify = true` in its TLS configuration with no operator override, making it the only outbound TLS client in the codebase that cannot be configured to verify pee...
Fixed in 1.27.0
SSRF and repository exfiltration via HTTP redirect bypass in Gitea (CVE-2026-57894)
Gitea validates the user-supplied URL before repository migration but passes the original URL to the Git command-line client, which follows HTTP redirects by default. A low-privileged authenticated user can supply a p...
Fixed in 1.27.0