Gitea
Monthly
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Gitea, the self-hosted Git service, received a security fix packaged by Alpine Linux in version 1.27.3-r0. The underlying vulnerability class, attack vector, affected component, and impact are entirely undisclosed in the available data - only the fix version is confirmed. Organizations running Gitea via Alpine Linux packages should treat this as an opaque security patch and upgrade without delay, as the absence of detail does not imply low severity.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability details - including attack vector, impact class, and root cause - are not disclosed in available intelligence sources. This entry is sourced exclusively from the Alpine Linux vendor advisory, which confirms a fix exists but provides no technical description of the flaw being addressed.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0, corresponding to upstream Gitea 1.27.3. The nature of the underlying vulnerability - its class, attack vector, and impact - is not described in the available intelligence. No CVSS score, CWE identifier, or technical detail has been published alongside this CVE, making independent risk assessment impossible at this time.
Gitea, a self-hosted Git service distributed via Alpine Linux, was patched in Alpine package version 1.27.3-r0. The underlying vulnerability type, attack surface, and impact are not disclosed in the available intelligence - only the fix version is confirmed. Security teams running Gitea on Alpine Linux should treat this as an uncharacterized upstream fix requiring prompt package upgrade, with risk level impossible to assess without further vendor disclosure.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability. The upstream CVE record provides no description, CWE classification, CVSS score, or exploitation details, making independent technical assessment impossible without additional vendor disclosure. Security teams running Gitea on Alpine Linux should treat this as a prompt to upgrade to the patched package version, pending full disclosure.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-63021. The underlying vulnerability type, affected component, and impact are not disclosed in the available intelligence - the only confirmed data point is the Alpine Linux vendor advisory identifying the fixed package version. No CVSS score, CWE classification, or vulnerability description is available to characterize the nature or severity of this issue.
Gitea, the self-hosted Git service, contains a vulnerability addressed in Alpine Linux package version 1.27.3-r0. The underlying nature of the flaw is undisclosed - no description, CVSS vector, or CWE has been published. The fix is confirmed via the Alpine Linux vendor advisory, but all technical details remain unavailable for independent analysis.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux at package version 1.27.3-r0, but the underlying vulnerability type, affected component, and impact are entirely undisclosed in the available CVE record. The record provides no description, CVSS score, CWE classification, or exploitation detail - only the patched package version. No active exploitation or public proof-of-concept has been identified at time of analysis.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-62925. The nature, root cause, and impact class of the underlying vulnerability are not disclosed in available intelligence - the only confirmed data point is the Alpine Linux package remediation. Security teams running Gitea on Alpine Linux should treat this as an uncharacterized security fix and upgrade promptly.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability. The upstream nature of the fix and the absence of a CVE description, CWE classification, or CVSS scoring means the specific vulnerability class, affected functionality, and attacker capability cannot be determined from available data. Security teams running Alpine Linux with Gitea should apply the patched package as a precaution pending full upstream disclosure.
Gitea as packaged in Alpine Linux has been patched in version 1.27.3-r0, addressing an unspecified vulnerability. The nature, impact class, and attack vector of the underlying flaw are not disclosed in the available intelligence - only the package-level fix version is confirmed. No CVSS score, CWE classification, or description of affected functionality has been published at time of analysis.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The upstream vulnerability details - including the specific weakness, affected component, and attack vector - are not disclosed in the available intelligence data. The Alpine Linux vendor advisory identifies the package correction but provides no CVE description, CWE classification, or CVSS scoring, making independent technical analysis of the vulnerability class impossible at this time.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability class and technical mechanism are not disclosed in available intelligence - the only confirmed data point is that Alpine Linux issued a patched package. Organizations running Gitea via Alpine Linux apk repositories should treat this as an uncharacterized security fix requiring immediate update.
Gitea 1.27.3 carries a vendor-confirmed security fix, packaged for Alpine Linux as gitea 1.27.3-r0, addressing an undisclosed vulnerability in the self-hosted Git service. The specific nature of the flaw - including its attack vector, impact class, and exploitability - is not described in any available intelligence source for this entry. The fix is confirmed solely through the Alpine Linux vendor security channel, indicating a real upstream patch was applied but not yet fully characterized in public advisories.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-60018. The underlying vulnerability type, affected component, and impact are not disclosed in available intelligence sources. No CVSS score, CWE classification, or technical description has been published at time of analysis, making independent severity assessment impossible without reviewing the upstream Gitea changelog or security advisory.
Gitea packaged in Alpine Linux contains an uncharacterized security vulnerability addressed in Alpine package version 1.27.3-r0. The nature, class, and impact of the underlying flaw are not disclosed in available data - only the fixed package version is confirmed. No CVSS score, CWE classification, or vulnerability description has been published, making independent risk assessment impossible at this time. No public exploit or CISA KEV listing exists.
Gitea on Alpine Linux received a security fix in package version 1.27.3-r0, addressing an unspecified vulnerability. The nature of the vulnerability, its attack vector, and its impact are entirely unknown from the available data - the description is a bare Alpine Linux package advisory string with no vulnerability details. Security teams should treat this as a patched-but-undescribed issue requiring vendor follow-up to assess actual risk.
Gitea received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability in the self-hosted Git service. The vulnerability type, attack vector, and impact are not disclosed in available intelligence - the record consists solely of an Alpine Linux package advisory naming the fixed version. No CVSS score, CWE classification, or description of exploitation conditions has been published at this time.
Gitea, as packaged in Alpine Linux, received a security fix in Alpine package version 1.27.3-r0. The underlying vulnerability details - including attack vector, affected functionality, and impact class - are not disclosed in the available intelligence; only the Alpine Linux vendor advisory confirming the fix in the 1.27.3-r0 package revision is on record. Operators running Gitea on Alpine Linux who have not upgraded to the patched package version should treat this as an uncharacterized security deficiency pending fuller upstream disclosure.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The specific vulnerability class, affected component, and attacker capabilities are not disclosed in the available CVE record. With no CVSS, CWE, or exploit data present, the full impact profile cannot be assessed from this record alone, and organizations should update promptly given that Gitea instances routinely hold sensitive source code, credentials, and CI/CD pipeline configurations.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability type, affected code path, and exploitability details are not disclosed in the available intelligence data - only the Alpine Linux vendor advisory identifying the fixed package version is present. Security teams running Gitea on Alpine Linux should upgrade to the fixed package regardless of the incomplete disclosure, as the fix designation indicates a confirmed security defect.
Gitea, a self-hosted Git service distributed via Alpine Linux, received a security fix packaged as gitea-1.27.3-r0. No vulnerability description, CWE classification, or CVSS metrics are provided in the available intelligence, making it impossible to characterize the specific flaw, attack vector, or impact class. Alpine Linux is the sole confirming source; operators running Gitea on Alpine Linux should upgrade to version 1.27.3-r0 immediately given the inherent sensitivity of code-repository infrastructure.
Gitea packages on Alpine Linux received a security fix in version 1.27.3-r0, addressing an unspecified vulnerability. The upstream CVE record provides no description, CVSS score, CWE classification, or technical detail about the nature or impact of the flaw. Security teams relying on this record cannot assess exploitability or impact from available data alone and should consult Gitea upstream release notes and the Alpine Linux changelog for 1.27.3-r0 directly.
Gitea, a self-hosted Git service distributed via Alpine Linux, received a security fix in package version 1.27.3-r0. The upstream vulnerability details - including the specific weakness, affected functionality, and attacker capabilities - have not been disclosed in the available intelligence. The fix is confirmed by the Alpine Linux vendor advisory, establishing that version 1.27.3-r0 or later of the Alpine package resolves the issue.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability details - including attack vector, impact, and root cause - are not disclosed in the available intelligence data. The fix is confirmed via the Alpine Linux vendor advisory, but no NVD description, CVSS vector, CWE classification, or technical writeup accompanies this CVE record at the time of analysis.
Gitea on Alpine Linux received a security fix packaged as 1.27.3-r0, addressing an unspecified vulnerability. The upstream vulnerability details - including attack vector, affected component, and impact class - are not disclosed in the available intelligence. The fix originates from an Alpine Linux vendor security notice, providing only package-level remediation information without describing the flaw's nature, severity, or exploitability.
Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Gitea, the self-hosted Git service, received a security fix packaged by Alpine Linux in version 1.27.3-r0. The underlying vulnerability class, attack vector, affected component, and impact are entirely undisclosed in the available data - only the fix version is confirmed. Organizations running Gitea via Alpine Linux packages should treat this as an opaque security patch and upgrade without delay, as the absence of detail does not imply low severity.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability details - including attack vector, impact class, and root cause - are not disclosed in available intelligence sources. This entry is sourced exclusively from the Alpine Linux vendor advisory, which confirms a fix exists but provides no technical description of the flaw being addressed.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0, corresponding to upstream Gitea 1.27.3. The nature of the underlying vulnerability - its class, attack vector, and impact - is not described in the available intelligence. No CVSS score, CWE identifier, or technical detail has been published alongside this CVE, making independent risk assessment impossible at this time.
Gitea, a self-hosted Git service distributed via Alpine Linux, was patched in Alpine package version 1.27.3-r0. The underlying vulnerability type, attack surface, and impact are not disclosed in the available intelligence - only the fix version is confirmed. Security teams running Gitea on Alpine Linux should treat this as an uncharacterized upstream fix requiring prompt package upgrade, with risk level impossible to assess without further vendor disclosure.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability. The upstream CVE record provides no description, CWE classification, CVSS score, or exploitation details, making independent technical assessment impossible without additional vendor disclosure. Security teams running Gitea on Alpine Linux should treat this as a prompt to upgrade to the patched package version, pending full disclosure.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-63021. The underlying vulnerability type, affected component, and impact are not disclosed in the available intelligence - the only confirmed data point is the Alpine Linux vendor advisory identifying the fixed package version. No CVSS score, CWE classification, or vulnerability description is available to characterize the nature or severity of this issue.
Gitea, the self-hosted Git service, contains a vulnerability addressed in Alpine Linux package version 1.27.3-r0. The underlying nature of the flaw is undisclosed - no description, CVSS vector, or CWE has been published. The fix is confirmed via the Alpine Linux vendor advisory, but all technical details remain unavailable for independent analysis.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux at package version 1.27.3-r0, but the underlying vulnerability type, affected component, and impact are entirely undisclosed in the available CVE record. The record provides no description, CVSS score, CWE classification, or exploitation detail - only the patched package version. No active exploitation or public proof-of-concept has been identified at time of analysis.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-62925. The nature, root cause, and impact class of the underlying vulnerability are not disclosed in available intelligence - the only confirmed data point is the Alpine Linux package remediation. Security teams running Gitea on Alpine Linux should treat this as an uncharacterized security fix and upgrade promptly.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability. The upstream nature of the fix and the absence of a CVE description, CWE classification, or CVSS scoring means the specific vulnerability class, affected functionality, and attacker capability cannot be determined from available data. Security teams running Alpine Linux with Gitea should apply the patched package as a precaution pending full upstream disclosure.
Gitea as packaged in Alpine Linux has been patched in version 1.27.3-r0, addressing an unspecified vulnerability. The nature, impact class, and attack vector of the underlying flaw are not disclosed in the available intelligence - only the package-level fix version is confirmed. No CVSS score, CWE classification, or description of affected functionality has been published at time of analysis.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The upstream vulnerability details - including the specific weakness, affected component, and attack vector - are not disclosed in the available intelligence data. The Alpine Linux vendor advisory identifies the package correction but provides no CVE description, CWE classification, or CVSS scoring, making independent technical analysis of the vulnerability class impossible at this time.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability class and technical mechanism are not disclosed in available intelligence - the only confirmed data point is that Alpine Linux issued a patched package. Organizations running Gitea via Alpine Linux apk repositories should treat this as an uncharacterized security fix requiring immediate update.
Gitea 1.27.3 carries a vendor-confirmed security fix, packaged for Alpine Linux as gitea 1.27.3-r0, addressing an undisclosed vulnerability in the self-hosted Git service. The specific nature of the flaw - including its attack vector, impact class, and exploitability - is not described in any available intelligence source for this entry. The fix is confirmed solely through the Alpine Linux vendor security channel, indicating a real upstream patch was applied but not yet fully characterized in public advisories.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-60018. The underlying vulnerability type, affected component, and impact are not disclosed in available intelligence sources. No CVSS score, CWE classification, or technical description has been published at time of analysis, making independent severity assessment impossible without reviewing the upstream Gitea changelog or security advisory.
Gitea packaged in Alpine Linux contains an uncharacterized security vulnerability addressed in Alpine package version 1.27.3-r0. The nature, class, and impact of the underlying flaw are not disclosed in available data - only the fixed package version is confirmed. No CVSS score, CWE classification, or vulnerability description has been published, making independent risk assessment impossible at this time. No public exploit or CISA KEV listing exists.
Gitea on Alpine Linux received a security fix in package version 1.27.3-r0, addressing an unspecified vulnerability. The nature of the vulnerability, its attack vector, and its impact are entirely unknown from the available data - the description is a bare Alpine Linux package advisory string with no vulnerability details. Security teams should treat this as a patched-but-undescribed issue requiring vendor follow-up to assess actual risk.
Gitea received a security fix in Alpine Linux package version 1.27.3-r0, addressing an unspecified vulnerability in the self-hosted Git service. The vulnerability type, attack vector, and impact are not disclosed in available intelligence - the record consists solely of an Alpine Linux package advisory naming the fixed version. No CVSS score, CWE classification, or description of exploitation conditions has been published at this time.
Gitea, as packaged in Alpine Linux, received a security fix in Alpine package version 1.27.3-r0. The underlying vulnerability details - including attack vector, affected functionality, and impact class - are not disclosed in the available intelligence; only the Alpine Linux vendor advisory confirming the fix in the 1.27.3-r0 package revision is on record. Operators running Gitea on Alpine Linux who have not upgraded to the patched package version should treat this as an uncharacterized security deficiency pending fuller upstream disclosure.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The specific vulnerability class, affected component, and attacker capabilities are not disclosed in the available CVE record. With no CVSS, CWE, or exploit data present, the full impact profile cannot be assessed from this record alone, and organizations should update promptly given that Gitea instances routinely hold sensitive source code, credentials, and CI/CD pipeline configurations.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability type, affected code path, and exploitability details are not disclosed in the available intelligence data - only the Alpine Linux vendor advisory identifying the fixed package version is present. Security teams running Gitea on Alpine Linux should upgrade to the fixed package regardless of the incomplete disclosure, as the fix designation indicates a confirmed security defect.
Gitea, a self-hosted Git service distributed via Alpine Linux, received a security fix packaged as gitea-1.27.3-r0. No vulnerability description, CWE classification, or CVSS metrics are provided in the available intelligence, making it impossible to characterize the specific flaw, attack vector, or impact class. Alpine Linux is the sole confirming source; operators running Gitea on Alpine Linux should upgrade to version 1.27.3-r0 immediately given the inherent sensitivity of code-repository infrastructure.
Gitea packages on Alpine Linux received a security fix in version 1.27.3-r0, addressing an unspecified vulnerability. The upstream CVE record provides no description, CVSS score, CWE classification, or technical detail about the nature or impact of the flaw. Security teams relying on this record cannot assess exploitability or impact from available data alone and should consult Gitea upstream release notes and the Alpine Linux changelog for 1.27.3-r0 directly.
Gitea, a self-hosted Git service distributed via Alpine Linux, received a security fix in package version 1.27.3-r0. The upstream vulnerability details - including the specific weakness, affected functionality, and attacker capabilities - have not been disclosed in the available intelligence. The fix is confirmed by the Alpine Linux vendor advisory, establishing that version 1.27.3-r0 or later of the Alpine package resolves the issue.
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0. The underlying vulnerability details - including attack vector, impact, and root cause - are not disclosed in the available intelligence data. The fix is confirmed via the Alpine Linux vendor advisory, but no NVD description, CVSS vector, CWE classification, or technical writeup accompanies this CVE record at the time of analysis.
Gitea on Alpine Linux received a security fix packaged as 1.27.3-r0, addressing an unspecified vulnerability. The upstream vulnerability details - including attack vector, affected component, and impact class - are not disclosed in the available intelligence. The fix originates from an Alpine Linux vendor security notice, providing only package-level remediation information without describing the flaw's nature, severity, or exploitability.