code.gitea.io/gitea vulnerabilities

CVEs whose affected-version data names the code.gitea.io/gitea package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

code.gitea.io/gitea vulnerabilities

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Gitea: Webhook Authorization Header Returned in Plaintext via API

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / …

Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Gitea: draft release attachment disclosure via missing web authorization

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions

Gitea: SSRF via HTTP Redirect in Repository Migration

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Gitea: Private Repository Metadata Remains Accessible After Access Revocation

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration