Security advisories

high2026-07-21

CVE-2026-58423-Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

go-gitea/gitea · GHSA-7wvc-rvp7-w99x

high2026-07-21

CVE-2026-58421-Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

go-gitea/gitea · GHSA-v96j-25gv-g2w9

medium2026-07-21

CVE-2026-58418-Gitea: SSRF via HTTP Redirect in Repository Migration

go-gitea/gitea · GHSA-rqhx-647v-wx32

medium2026-07-21

CVE-2026-27761-Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

go-gitea/gitea · GHSA-3pww-vcvm-3gmj

high2026-07-21

CVE-2026-28740-Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

go-gitea/gitea · GHSA-2m9v-5q2g-58vq

critical2026-07-21

CVE-2026-20896-Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

go-gitea/gitea · GHSA-f75j-4cw6-rmx4

critical2026-07-21

CVE-2026-22874-Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

go-gitea/gitea · GHSA-2r5c-gw76-rh3w

medium2026-07-21

Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions

go-gitea/gitea · GHSA-rjvx-x5h2-6px5

high2026-07-21

CVE-2026-56654-Gitea: Privilege Escalation via Access Token Scope Escalation in API

go-gitea/gitea · GHSA-683j-3ff6-hh2x

high2026-07-21

CVE-2026-56755-Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

go-gitea/gitea · GHSA-6hm7-3pwj-22rm

medium2026-07-21

CVE-2026-58507-Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

go-gitea/gitea · GHSA-p4mj-98mv-xq26

medium2026-07-21

CVE-2026-57886-Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

go-gitea/gitea · GHSA-6c6r-5xr4-cr5m

low2026-07-21

CVE-2026-23603-Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

go-gitea/gitea · GHSA-x77v-q46j-393g

medium2026-07-21

CVE-2026-58425-Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

go-gitea/gitea · GHSA-vxv2-8j6r-pcpg

medium2026-07-21

CVE-2026-59763-Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

go-gitea/gitea · GHSA-9mq6-mqjj-c2c5

critical2026-07-21

CVE-2026-56750-Gitea Remember-Me Token Theft Not Invalidating Attacker Session

go-gitea/gitea · GHSA-rgv6-xp99-6mgj

medium2026-07-21

CVE-2026-58432-Gitea: draft release attachment disclosure via missing web authorization

go-gitea/gitea · GHSA-q9pg-jj6x-j9p6

medium2026-07-21

CVE-2026-58428-Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

go-gitea/gitea · GHSA-25gq-j9jx-43pg

medium2026-07-21

CVE-2026-56443-Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

go-gitea/gitea · GHSA-7p4h-3gxq-x3h3

high2026-07-21

CVE-2026-58439-Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

go-gitea/gitea · GHSA-w5pg-649r-p6gg