code.gitea.io/gitea vulnerabilities

CVEs whose affected-version data names the code.gitea.io/gitea package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

code.gitea.io/gitea vulnerabilities

Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Gitea LFS Deploy-Key Privilege Escalation

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Gitea: Repository Visibility Manipulation via Git Push Options

Gitea SSH Key Parser Denial of Service

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Gitea: Two SSRF findings

Gitea: Notification API leaks private issue metadata after access revocation

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Gitea: Webhook Authorization Header Returned in Plaintext via API

Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Gitea: draft release attachment disclosure via missing web authorization

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions