Security advisories

high2026-07-21

CVE-2026-58437-Gitea: Repository Visibility Manipulation via Git Push Options

go-gitea/gitea · GHSA-8p9h-49rc-qgxj

high2026-07-21

CVE-2026-55987-Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

go-gitea/gitea · GHSA-vrhc-jjfc-m3m3

medium2026-07-21

CVE-2026-58435-Gitea LFS Deploy-Key Privilege Escalation

go-gitea/gitea · GHSA-rh79-75qm-gwjr

medium2026-07-21

CVE-2026-58420-Gitea: Local File Inclusion via file:// URI in Migration Restore

go-gitea/gitea · GHSA-5ggr-2f2h-jmvm

low2026-07-21

CVE-2026-55984-Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

go-gitea/gitea · GHSA-m932-crvm-gcp5

medium2026-07-21

CVE-2026-55982-Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

go-gitea/gitea · GHSA-mg4f-x9v4-6h2p

low2026-07-21

CVE-2026-58434-Gitea: Private Repository Metadata Remains Accessible After Access Revocation

go-gitea/gitea · GHSA-j2w3-9c3r-g83q

high2026-07-21

CVE-2026-54481-Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

go-gitea/gitea · GHSA-94v3-77j7-vm48

medium2026-07-21

CVE-2026-58417-Gitea: REST API exposes organization membership of private organizations to public

go-gitea/gitea · GHSA-jr5x-6h83-wrxf

medium2026-07-21

CVE-2026-50105-Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

go-gitea/gitea · GHSA-6cqf-375w-639g

medium2026-07-21

CVE-2026-58416-Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

go-gitea/gitea · GHSA-fj8v-hjwv-qm88

medium2026-07-21

CVE-2026-42931-Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

go-gitea/gitea · GHSA-wwqq-x6w4-frm2

low2026-07-21

CVE-2026-58445-Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

go-gitea/gitea · GHSA-pgqf-926r-548m

medium2026-07-21

CVE-2026-58444-Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

go-gitea/gitea · GHSA-cp3q-vrj2-ghhh

critical2026-07-21

CVE-2026-58443-Gitea: Public-only repository tokens can update private PR head branches

go-gitea/gitea · GHSA-xxjv-752h-3vp2

medium2026-07-21

CVE-2026-58442-Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

go-gitea/gitea · GHSA-h2x6-g7q6-344v

medium2026-07-21

CVE-2026-58441-Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

go-gitea/gitea · GHSA-xmj7-xj85-hfc3

low2026-07-21

CVE-2026-58438-Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

go-gitea/gitea · GHSA-xv9x-fj9g-vj6h

critical2026-07-21

CVE-2026-58426-Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

go-gitea/gitea · GHSA-hg5r-vq93-9fv6

high2026-07-21

CVE-2026-58424-Gitea: Permanent Fork PR Workflow Approval Gate Bypass

go-gitea/gitea · GHSA-777r-4v59-6486