Gitea
Monthly
Insecure direct object reference (IDOR) in Gitea's issue time-tracking feature allows authenticated users to delete tracked-time entries belonging to issues other than the one specified in the request URL. Affected are all Gitea Open Source Git Server versions before 1.25.5. The root cause is that `GetTrackedTimeByID` performed a database lookup using only the time entry's numeric ID, without filtering by the issue ID present in the URL path, enabling cross-issue data manipulation. No public exploit has been identified at time of analysis, and CISA KEV does not list this vulnerability.
Unauthorized read access to tracked time entries in Gitea before 1.25.5 exposes private repository metadata to unauthenticated network actors due to missing repository-level permission checks during API serialization (CWE-284). The flaw exists in the `ToStopWatches` and `ToTrackedTimeList` conversion functions in `services/convert/issue.go`, which iterated over and returned time entries without verifying the requesting user held read access to the underlying repository. No public exploit has been identified and CISA has not added this to KEV; however, the SSVC assessment designates the flaw as automatable, meaning it can be scripted at scale against all exposed Gitea instances running affected versions.
Open redirect in Gitea's login flow allows external domain hijacking by bypassing the `urlIsRelative` validation in `modules/httplib/url.go` through a combination of directory traversal sequences and a backslash in the `redirect_to` parameter. All Gitea instances running version 1.25.4 and below are affected; a working proof-of-concept is publicly available in the GitHub Security Advisory. Exploitation enables phishing via trusted Gitea domains, OAuth/SSO authorization code theft, Referer-header leakage of sensitive parameters, and potential cache poisoning — no public exploit identified as confirmed actively exploited (CISA KEV absent).
Missing repository-unit authorization on three Gitea API endpoints allows authenticated users with only non-Code unit access (e.g., an Issues-only organization team member) to read `.gitea/ISSUE_TEMPLATE/*` and `issue_config.yaml` files from the Code default branch of a private repository. The CVSS score of 4.3 (PR:L, C:L) accurately reflects the narrow scope: exploitation is limited to those specific configuration files, not arbitrary source code. A proof of concept is publicly documented in the vendor advisory (GHSA-3fwp-p5rj-2pxf); no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
Public-only scoped API tokens in Gitea bypass their declared scope constraints and expose private organization membership data through two distinct code defects in `routers/api/v1/api.go`: the `/user/orgs` route omits the `checkTokenPublicOnly()` middleware entirely, and the `checkTokenPublicOnly` function contains a Go switch-case logic flaw that skips the user-visibility check on multi-category routes. This is an incomplete remediation of CVE-2025-68941 introduced by PR #32204, affecting all Gitea instances running version 1.26.1 and earlier. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack is trivially reproducible from the published advisory steps.
Gitea's OpenID URI visibility controls lack proper ownership validation, allowing authenticated users to modify the visibility settings of other users' OpenID identities. This integrity bypass affects any Gitea instance where multiple users manage OpenID configurations, enabling account enumeration or information disclosure through unauthorized visibility changes. A patch is available to remediate this medium-severity vulnerability.
Gitea fails to enforce proper authorization checks when users attempt to cancel scheduled auto-merges through the web interface, allowing any user with pull request read access to cancel merge operations initiated by other users. This authorization bypass could disrupt automated workflows and merge processes across repositories. A patch is available to address this vulnerability.
Gitea's stopwatch API fails to re-validate repository access permissions, allowing revoked users to access sensitive information through active stopwatch sessions. An authenticated attacker with prior access to a private repository can enumerate issue titles and repository names even after their permissions have been removed. A patch is available to enforce proper access control validation.
Gitea's notification API fails to re-validate repository access permissions when retrieving notification details, allowing users with revoked access to private repositories to continue viewing issue and pull request titles through cached notifications. An authenticated attacker can exploit this to maintain visibility into sensitive repository content after their access has been removed. A patch is available.
Gitea may send release notification emails for private repositories to users whose access has been revoked. [CVSS 3.5 LOW]
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. [CVSS 5.3 MEDIUM]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.22.0. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. Public exploit code available.
In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF) attacks. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Gitea on Alpine Linux received a security fix packaged as gitea-1.27.3-r0, indicating an unspecified vulnerability was patched in this self-hosted Git service. The nature of the flaw, attack vector, and achievable impact are entirely undisclosed in available intelligence - only the corrected Alpine package version is confirmed. No CVSS score, CWE class, or vulnerability description accompanies this entry, making meaningful risk characterization impossible without additional vendor disclosure.
Gitea, a self-hosted Git service distributed via Alpine Linux, received a security fix in package version 1.27.3-r0. The upstream vulnerability details - including the specific weakness, affected functionality, and attacker capabilities - have not been disclosed in the available intelligence. The fix is confirmed by the Alpine Linux vendor advisory, establishing that version 1.27.3-r0 or later of the Alpine package resolves the issue.
Gitea packages on Alpine Linux received a security fix in version 1.27.3-r0, addressing an unspecified vulnerability. The upstream CVE record provides no description, CVSS score, CWE classification, or technical detail about the nature or impact of the flaw. Security teams relying on this record cannot assess exploitability or impact from available data alone and should consult Gitea upstream release notes and the Alpine Linux changelog for 1.27.3-r0 directly.
Gitea, a self-hosted Git service distributed via Alpine Linux, received a security fix packaged as gitea-1.27.3-r0. No vulnerability description, CWE classification, or CVSS metrics are provided in the available intelligence, making it impossible to characterize the specific flaw, attack vector, or impact class. Alpine Linux is the sole confirming source; operators running Gitea on Alpine Linux should upgrade to version 1.27.3-r0 immediately given the inherent sensitivity of code-repository infrastructure.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability type, affected code path, and exploitability details are not disclosed in the available intelligence data - only the Alpine Linux vendor advisory identifying the fixed package version is present. Security teams running Gitea on Alpine Linux should upgrade to the fixed package regardless of the incomplete disclosure, as the fix designation indicates a confirmed security defect.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The specific vulnerability class, affected component, and attacker capabilities are not disclosed in the available CVE record. With no CVSS, CWE, or exploit data present, the full impact profile cannot be assessed from this record alone, and organizations should update promptly given that Gitea instances routinely hold sensitive source code, credentials, and CI/CD pipeline configurations.
Gitea, as packaged in Alpine Linux, received a security fix in Alpine package version 1.27.3-r0. The underlying vulnerability details - including attack vector, affected functionality, and impact class - are not disclosed in the available intelligence; only the Alpine Linux vendor advisory confirming the fix in the 1.27.3-r0 package revision is on record. Operators running Gitea on Alpine Linux who have not upgraded to the patched package version should treat this as an uncharacterized security deficiency pending fuller upstream disclosure.
Gitea received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability in the self-hosted Git service. The vulnerability type, attack vector, and impact are not disclosed in available intelligence - the record consists solely of an Alpine Linux package advisory naming the fixed version. No CVSS score, CWE classification, or description of exploitation conditions has been published at this time.
Gitea on Alpine Linux received a security fix in package version 1.27.3-r0, addressing an unspecified vulnerability. The nature of the vulnerability, its attack vector, and its impact are entirely unknown from the available data - the description is a bare Alpine Linux package advisory string with no vulnerability details. Security teams should treat this as a patched-but-undescribed issue requiring vendor follow-up to assess actual risk.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The upstream Gitea version addressed is 1.27.3. No vulnerability description, CVSS score, CWE classification, or exploitation details are available from the provided intelligence sources, making independent impact assessment impossible at this time. Security teams running Gitea on Alpine Linux should treat this as a security-relevant update and upgrade promptly.
Gitea 1.27.3 carries a vendor-confirmed security fix, packaged for Alpine Linux as gitea 1.27.3-r0, addressing an undisclosed vulnerability in the self-hosted Git service. The specific nature of the flaw - including its attack vector, impact class, and exploitability - is not described in any available intelligence source for this entry. The fix is confirmed solely through the Alpine Linux vendor security channel, indicating a real upstream patch was applied but not yet fully characterized in public advisories.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability details - including attack vector, impact, and root cause - are not disclosed in the available intelligence data. The fix is confirmed via the Alpine Linux vendor advisory, but no NVD description, CVSS vector, CWE classification, or technical writeup accompanies this CVE record at the time of analysis.
Gitea, a self-hosted Git service distributed via Alpine Linux, was patched in Alpine package version 1.27.3-r0. The underlying vulnerability type, attack surface, and impact are not disclosed in the available intelligence - only the fix version is confirmed. Security teams running Gitea on Alpine Linux should treat this as an uncharacterized upstream fix requiring prompt package upgrade, with risk level impossible to assess without further vendor disclosure.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability. The upstream CVE record provides no description, CWE classification, CVSS score, or exploitation details, making independent technical assessment impossible without additional vendor disclosure. Security teams running Gitea on Alpine Linux should treat this as a prompt to upgrade to the patched package version, pending full disclosure.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-63021. The underlying vulnerability type, affected component, and impact are not disclosed in the available intelligence - the only confirmed data point is the Alpine Linux vendor advisory identifying the fixed package version. No CVSS score, CWE classification, or vulnerability description is available to characterize the nature or severity of this issue.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-62925. The nature, root cause, and impact class of the underlying vulnerability are not disclosed in available intelligence - the only confirmed data point is the Alpine Linux package remediation. Security teams running Gitea on Alpine Linux should treat this as an uncharacterized security fix and upgrade promptly.
Gitea packaged in Alpine Linux contains an uncharacterized security vulnerability addressed in Alpine package version 1.27.3-r0. The nature, class, and impact of the underlying flaw are not disclosed in available data - only the fixed package version is confirmed. No CVSS score, CWE classification, or vulnerability description has been published, making independent risk assessment impossible at this time. No public exploit or CISA KEV listing exists.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-60018. The underlying vulnerability type, affected component, and impact are not disclosed in available intelligence sources. No CVSS score, CWE classification, or technical description has been published at time of analysis, making independent severity assessment impossible without reviewing the upstream Gitea changelog or security advisory.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability class and technical mechanism are not disclosed in available intelligence - the only confirmed data point is that Alpine Linux issued a patched package. Organizations running Gitea via Alpine Linux apk repositories should treat this as an uncharacterized security fix requiring immediate update.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The upstream vulnerability details - including the specific weakness, affected component, and attack vector - are not disclosed in the available intelligence data. The Alpine Linux vendor advisory identifies the package correction but provides no CVE description, CWE classification, or CVSS scoring, making independent technical analysis of the vulnerability class impossible at this time.
Gitea received a security fix in Alpine Linux package version 1.27.1-r0, addressing an unspecified vulnerability tracked as CVE-2026-59774. The underlying vulnerability class, attack vector, and impact are not disclosed in the available intelligence. Administrators running Gitea on Alpine Linux should treat this as an uncharacterized security fix and upgrade promptly, as the absence of public detail does not imply low severity.
Gitea as packaged in Alpine Linux has been patched in version 1.27.3-r0, addressing an unspecified vulnerability. The nature, impact class, and attack vector of the underlying flaw are not disclosed in the available intelligence - only the package-level fix version is confirmed. No CVSS score, CWE classification, or description of affected functionality has been published at time of analysis.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability. The upstream nature of the fix and the absence of a CVE description, CWE classification, or CVSS scoring means the specific vulnerability class, affected functionality, and attacker capability cannot be determined from available data. Security teams running Alpine Linux with Gitea should apply the patched package as a precaution pending full upstream disclosure.
Gitea, a self-hosted Git service, received a security fix in its Alpine Linux package build at version 1.27.3-r0. The nature and severity of the underlying vulnerability are not described in available data - only the patched Alpine package version is disclosed. No CVSS score, CWE classification, or technical description has been published, making independent risk assessment difficult without consulting the upstream Gitea release notes or changelog.
Gitea, the self-hosted Git service, received a security fix packaged by Alpine Linux as gitea 1.27.3-r0. The underlying vulnerability - its class, attack vector, and impact - is not described in any available intelligence source. The Alpine Linux vendor advisory confirms a security-motivated package update but provides no further disclosure about what was corrected.
Gitea, the self-hosted Git service, received a security fix packaged in Alpine Linux as version 1.27.3-r0. The underlying vulnerability type, root cause, and attacker-accessible impact are not described in the available intelligence - only that a fix was shipped in this Alpine package revision. Security teams running Gitea on Alpine Linux should treat this as an uncharacterized security update requiring upgrade.
Gitea, a self-hosted Git service, received a security fix packaged by Alpine Linux in version 1.27.3-r0. The underlying vulnerability details - including attack vector, impact class, and affected Gitea upstream release - are not disclosed in the available intelligence. The Alpine Linux package maintainers have issued the corrected package, indicating the fix corresponds to Gitea upstream version 1.27.3 as packaged for Alpine's apk ecosystem.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux at package version 1.27.3-r0, but the underlying vulnerability type, affected component, and impact are entirely undisclosed in the available CVE record. The record provides no description, CVSS score, CWE classification, or exploitation detail - only the patched package version. No active exploitation or public proof-of-concept has been identified at time of analysis.
Gitea, a self-hosted Git service distributed via Alpine Linux, received a security fix in Alpine package version 1.27.3-r0. The nature of the underlying vulnerability - its class, attack vector, and impact - is entirely undisclosed in the available data. No CVSS score, CWE identifier, or descriptive detail has been published, leaving the severity and exploitability of this issue uncharacterizable from current intelligence sources.
Gitea, the self-hosted Git service, contains a vulnerability addressed in Alpine Linux package version 1.27.3-r0. The underlying nature of the flaw is undisclosed - no description, CVSS vector, or CWE has been published. The fix is confirmed via the Alpine Linux vendor advisory, but all technical details remain unavailable for independent analysis.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0, corresponding to upstream Gitea 1.27.3. The nature of the underlying vulnerability - its class, attack vector, and impact - is not described in the available intelligence. No CVSS score, CWE identifier, or technical detail has been published alongside this CVE, making independent risk assessment impossible at this time.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability details - including attack vector, impact class, and root cause - are not disclosed in available intelligence sources. This entry is sourced exclusively from the Alpine Linux vendor advisory, which confirms a fix exists but provides no technical description of the flaw being addressed.
Gitea, the self-hosted Git service, received a security fix packaged by Alpine Linux in version 1.27.3-r0. The underlying vulnerability class, attack vector, affected component, and impact are entirely undisclosed in the available data - only the fix version is confirmed. Organizations running Gitea via Alpine Linux packages should treat this as an opaque security patch and upgrade without delay, as the absence of detail does not imply low severity.
Gitea on Alpine Linux received a security fix packaged as 1.27.3-r0, addressing an unspecified vulnerability. The upstream vulnerability details - including attack vector, affected component, and impact class - are not disclosed in the available intelligence. The fix originates from an Alpine Linux vendor security notice, providing only package-level remediation information without describing the flaw's nature, severity, or exploitability.
Insecure direct object reference (IDOR) in Gitea's issue time-tracking feature allows authenticated users to delete tracked-time entries belonging to issues other than the one specified in the request URL. Affected are all Gitea Open Source Git Server versions before 1.25.5. The root cause is that `GetTrackedTimeByID` performed a database lookup using only the time entry's numeric ID, without filtering by the issue ID present in the URL path, enabling cross-issue data manipulation. No public exploit has been identified at time of analysis, and CISA KEV does not list this vulnerability.
Unauthorized read access to tracked time entries in Gitea before 1.25.5 exposes private repository metadata to unauthenticated network actors due to missing repository-level permission checks during API serialization (CWE-284). The flaw exists in the `ToStopWatches` and `ToTrackedTimeList` conversion functions in `services/convert/issue.go`, which iterated over and returned time entries without verifying the requesting user held read access to the underlying repository. No public exploit has been identified and CISA has not added this to KEV; however, the SSVC assessment designates the flaw as automatable, meaning it can be scripted at scale against all exposed Gitea instances running affected versions.
Open redirect in Gitea's login flow allows external domain hijacking by bypassing the `urlIsRelative` validation in `modules/httplib/url.go` through a combination of directory traversal sequences and a backslash in the `redirect_to` parameter. All Gitea instances running version 1.25.4 and below are affected; a working proof-of-concept is publicly available in the GitHub Security Advisory. Exploitation enables phishing via trusted Gitea domains, OAuth/SSO authorization code theft, Referer-header leakage of sensitive parameters, and potential cache poisoning — no public exploit identified as confirmed actively exploited (CISA KEV absent).
Missing repository-unit authorization on three Gitea API endpoints allows authenticated users with only non-Code unit access (e.g., an Issues-only organization team member) to read `.gitea/ISSUE_TEMPLATE/*` and `issue_config.yaml` files from the Code default branch of a private repository. The CVSS score of 4.3 (PR:L, C:L) accurately reflects the narrow scope: exploitation is limited to those specific configuration files, not arbitrary source code. A proof of concept is publicly documented in the vendor advisory (GHSA-3fwp-p5rj-2pxf); no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
Public-only scoped API tokens in Gitea bypass their declared scope constraints and expose private organization membership data through two distinct code defects in `routers/api/v1/api.go`: the `/user/orgs` route omits the `checkTokenPublicOnly()` middleware entirely, and the `checkTokenPublicOnly` function contains a Go switch-case logic flaw that skips the user-visibility check on multi-category routes. This is an incomplete remediation of CVE-2025-68941 introduced by PR #32204, affecting all Gitea instances running version 1.26.1 and earlier. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack is trivially reproducible from the published advisory steps.
Gitea's OpenID URI visibility controls lack proper ownership validation, allowing authenticated users to modify the visibility settings of other users' OpenID identities. This integrity bypass affects any Gitea instance where multiple users manage OpenID configurations, enabling account enumeration or information disclosure through unauthorized visibility changes. A patch is available to remediate this medium-severity vulnerability.
Gitea fails to enforce proper authorization checks when users attempt to cancel scheduled auto-merges through the web interface, allowing any user with pull request read access to cancel merge operations initiated by other users. This authorization bypass could disrupt automated workflows and merge processes across repositories. A patch is available to address this vulnerability.
Gitea's stopwatch API fails to re-validate repository access permissions, allowing revoked users to access sensitive information through active stopwatch sessions. An authenticated attacker with prior access to a private repository can enumerate issue titles and repository names even after their permissions have been removed. A patch is available to enforce proper access control validation.
Gitea's notification API fails to re-validate repository access permissions when retrieving notification details, allowing users with revoked access to private repositories to continue viewing issue and pull request titles through cached notifications. An authenticated attacker can exploit this to maintain visibility into sensitive repository content after their access has been removed. A patch is available.
Gitea may send release notification emails for private repositories to users whose access has been revoked. [CVSS 3.5 LOW]
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. [CVSS 5.3 MEDIUM]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.22.0. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. Public exploit code available.
In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF) attacks. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Gitea on Alpine Linux received a security fix packaged as gitea-1.27.3-r0, indicating an unspecified vulnerability was patched in this self-hosted Git service. The nature of the flaw, attack vector, and achievable impact are entirely undisclosed in available intelligence - only the corrected Alpine package version is confirmed. No CVSS score, CWE class, or vulnerability description accompanies this entry, making meaningful risk characterization impossible without additional vendor disclosure.
Gitea, a self-hosted Git service distributed via Alpine Linux, received a security fix in package version 1.27.3-r0. The upstream vulnerability details - including the specific weakness, affected functionality, and attacker capabilities - have not been disclosed in the available intelligence. The fix is confirmed by the Alpine Linux vendor advisory, establishing that version 1.27.3-r0 or later of the Alpine package resolves the issue.
Gitea packages on Alpine Linux received a security fix in version 1.27.3-r0, addressing an unspecified vulnerability. The upstream CVE record provides no description, CVSS score, CWE classification, or technical detail about the nature or impact of the flaw. Security teams relying on this record cannot assess exploitability or impact from available data alone and should consult Gitea upstream release notes and the Alpine Linux changelog for 1.27.3-r0 directly.
Gitea, a self-hosted Git service distributed via Alpine Linux, received a security fix packaged as gitea-1.27.3-r0. No vulnerability description, CWE classification, or CVSS metrics are provided in the available intelligence, making it impossible to characterize the specific flaw, attack vector, or impact class. Alpine Linux is the sole confirming source; operators running Gitea on Alpine Linux should upgrade to version 1.27.3-r0 immediately given the inherent sensitivity of code-repository infrastructure.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability type, affected code path, and exploitability details are not disclosed in the available intelligence data - only the Alpine Linux vendor advisory identifying the fixed package version is present. Security teams running Gitea on Alpine Linux should upgrade to the fixed package regardless of the incomplete disclosure, as the fix designation indicates a confirmed security defect.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The specific vulnerability class, affected component, and attacker capabilities are not disclosed in the available CVE record. With no CVSS, CWE, or exploit data present, the full impact profile cannot be assessed from this record alone, and organizations should update promptly given that Gitea instances routinely hold sensitive source code, credentials, and CI/CD pipeline configurations.
Gitea, as packaged in Alpine Linux, received a security fix in Alpine package version 1.27.3-r0. The underlying vulnerability details - including attack vector, affected functionality, and impact class - are not disclosed in the available intelligence; only the Alpine Linux vendor advisory confirming the fix in the 1.27.3-r0 package revision is on record. Operators running Gitea on Alpine Linux who have not upgraded to the patched package version should treat this as an uncharacterized security deficiency pending fuller upstream disclosure.
Gitea received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability in the self-hosted Git service. The vulnerability type, attack vector, and impact are not disclosed in available intelligence - the record consists solely of an Alpine Linux package advisory naming the fixed version. No CVSS score, CWE classification, or description of exploitation conditions has been published at this time.
Gitea on Alpine Linux received a security fix in package version 1.27.3-r0, addressing an unspecified vulnerability. The nature of the vulnerability, its attack vector, and its impact are entirely unknown from the available data - the description is a bare Alpine Linux package advisory string with no vulnerability details. Security teams should treat this as a patched-but-undescribed issue requiring vendor follow-up to assess actual risk.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The upstream Gitea version addressed is 1.27.3. No vulnerability description, CVSS score, CWE classification, or exploitation details are available from the provided intelligence sources, making independent impact assessment impossible at this time. Security teams running Gitea on Alpine Linux should treat this as a security-relevant update and upgrade promptly.
Gitea 1.27.3 carries a vendor-confirmed security fix, packaged for Alpine Linux as gitea 1.27.3-r0, addressing an undisclosed vulnerability in the self-hosted Git service. The specific nature of the flaw - including its attack vector, impact class, and exploitability - is not described in any available intelligence source for this entry. The fix is confirmed solely through the Alpine Linux vendor security channel, indicating a real upstream patch was applied but not yet fully characterized in public advisories.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability details - including attack vector, impact, and root cause - are not disclosed in the available intelligence data. The fix is confirmed via the Alpine Linux vendor advisory, but no NVD description, CVSS vector, CWE classification, or technical writeup accompanies this CVE record at the time of analysis.
Gitea, a self-hosted Git service distributed via Alpine Linux, was patched in Alpine package version 1.27.3-r0. The underlying vulnerability type, attack surface, and impact are not disclosed in the available intelligence - only the fix version is confirmed. Security teams running Gitea on Alpine Linux should treat this as an uncharacterized upstream fix requiring prompt package upgrade, with risk level impossible to assess without further vendor disclosure.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability. The upstream CVE record provides no description, CWE classification, CVSS score, or exploitation details, making independent technical assessment impossible without additional vendor disclosure. Security teams running Gitea on Alpine Linux should treat this as a prompt to upgrade to the patched package version, pending full disclosure.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-63021. The underlying vulnerability type, affected component, and impact are not disclosed in the available intelligence - the only confirmed data point is the Alpine Linux vendor advisory identifying the fixed package version. No CVSS score, CWE classification, or vulnerability description is available to characterize the nature or severity of this issue.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-62925. The nature, root cause, and impact class of the underlying vulnerability are not disclosed in available intelligence - the only confirmed data point is the Alpine Linux package remediation. Security teams running Gitea on Alpine Linux should treat this as an uncharacterized security fix and upgrade promptly.
Gitea packaged in Alpine Linux contains an uncharacterized security vulnerability addressed in Alpine package version 1.27.3-r0. The nature, class, and impact of the underlying flaw are not disclosed in available data - only the fixed package version is confirmed. No CVSS score, CWE classification, or vulnerability description has been published, making independent risk assessment impossible at this time. No public exploit or CISA KEV listing exists.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-60018. The underlying vulnerability type, affected component, and impact are not disclosed in available intelligence sources. No CVSS score, CWE classification, or technical description has been published at time of analysis, making independent severity assessment impossible without reviewing the upstream Gitea changelog or security advisory.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability class and technical mechanism are not disclosed in available intelligence - the only confirmed data point is that Alpine Linux issued a patched package. Organizations running Gitea via Alpine Linux apk repositories should treat this as an uncharacterized security fix requiring immediate update.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The upstream vulnerability details - including the specific weakness, affected component, and attack vector - are not disclosed in the available intelligence data. The Alpine Linux vendor advisory identifies the package correction but provides no CVE description, CWE classification, or CVSS scoring, making independent technical analysis of the vulnerability class impossible at this time.
Gitea received a security fix in Alpine Linux package version 1.27.1-r0, addressing an unspecified vulnerability tracked as CVE-2026-59774. The underlying vulnerability class, attack vector, and impact are not disclosed in the available intelligence. Administrators running Gitea on Alpine Linux should treat this as an uncharacterized security fix and upgrade promptly, as the absence of public detail does not imply low severity.
Gitea as packaged in Alpine Linux has been patched in version 1.27.3-r0, addressing an unspecified vulnerability. The nature, impact class, and attack vector of the underlying flaw are not disclosed in the available intelligence - only the package-level fix version is confirmed. No CVSS score, CWE classification, or description of affected functionality has been published at time of analysis.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability. The upstream nature of the fix and the absence of a CVE description, CWE classification, or CVSS scoring means the specific vulnerability class, affected functionality, and attacker capability cannot be determined from available data. Security teams running Alpine Linux with Gitea should apply the patched package as a precaution pending full upstream disclosure.
Gitea, a self-hosted Git service, received a security fix in its Alpine Linux package build at version 1.27.3-r0. The nature and severity of the underlying vulnerability are not described in available data - only the patched Alpine package version is disclosed. No CVSS score, CWE classification, or technical description has been published, making independent risk assessment difficult without consulting the upstream Gitea release notes or changelog.
Gitea, the self-hosted Git service, received a security fix packaged by Alpine Linux as gitea 1.27.3-r0. The underlying vulnerability - its class, attack vector, and impact - is not described in any available intelligence source. The Alpine Linux vendor advisory confirms a security-motivated package update but provides no further disclosure about what was corrected.
Gitea, the self-hosted Git service, received a security fix packaged in Alpine Linux as version 1.27.3-r0. The underlying vulnerability type, root cause, and attacker-accessible impact are not described in the available intelligence - only that a fix was shipped in this Alpine package revision. Security teams running Gitea on Alpine Linux should treat this as an uncharacterized security update requiring upgrade.
Gitea, a self-hosted Git service, received a security fix packaged by Alpine Linux in version 1.27.3-r0. The underlying vulnerability details - including attack vector, impact class, and affected Gitea upstream release - are not disclosed in the available intelligence. The Alpine Linux package maintainers have issued the corrected package, indicating the fix corresponds to Gitea upstream version 1.27.3 as packaged for Alpine's apk ecosystem.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux at package version 1.27.3-r0, but the underlying vulnerability type, affected component, and impact are entirely undisclosed in the available CVE record. The record provides no description, CVSS score, CWE classification, or exploitation detail - only the patched package version. No active exploitation or public proof-of-concept has been identified at time of analysis.
Gitea, a self-hosted Git service distributed via Alpine Linux, received a security fix in Alpine package version 1.27.3-r0. The nature of the underlying vulnerability - its class, attack vector, and impact - is entirely undisclosed in the available data. No CVSS score, CWE identifier, or descriptive detail has been published, leaving the severity and exploitability of this issue uncharacterizable from current intelligence sources.
Gitea, the self-hosted Git service, contains a vulnerability addressed in Alpine Linux package version 1.27.3-r0. The underlying nature of the flaw is undisclosed - no description, CVSS vector, or CWE has been published. The fix is confirmed via the Alpine Linux vendor advisory, but all technical details remain unavailable for independent analysis.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0, corresponding to upstream Gitea 1.27.3. The nature of the underlying vulnerability - its class, attack vector, and impact - is not described in the available intelligence. No CVSS score, CWE identifier, or technical detail has been published alongside this CVE, making independent risk assessment impossible at this time.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability details - including attack vector, impact class, and root cause - are not disclosed in available intelligence sources. This entry is sourced exclusively from the Alpine Linux vendor advisory, which confirms a fix exists but provides no technical description of the flaw being addressed.
Gitea, the self-hosted Git service, received a security fix packaged by Alpine Linux in version 1.27.3-r0. The underlying vulnerability class, attack vector, affected component, and impact are entirely undisclosed in the available data - only the fix version is confirmed. Organizations running Gitea via Alpine Linux packages should treat this as an opaque security patch and upgrade without delay, as the absence of detail does not imply low severity.
Gitea on Alpine Linux received a security fix packaged as 1.27.3-r0, addressing an unspecified vulnerability. The upstream vulnerability details - including attack vector, affected component, and impact class - are not disclosed in the available intelligence. The fix originates from an Alpine Linux vendor security notice, providing only package-level remediation information without describing the flaw's nature, severity, or exploitability.