code.gitea.io/gitea vulnerabilities
CVEs whose affected-version data names the code.gitea.io/gitea package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
69 CVEsRSS
CVE-2026-22555High· 8.1Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
CVE-2026-24791High· 8.1Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
CVE-2026-28737High· 8.7Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
CVE-2026-28744High· 8.1Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
CVE-2026-28699High· 8.1PoCGitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication
Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication
CVE-2026-26231High· 8.5Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
CVE-2026-25714Medium· 4.3Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw
Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw
CVE-2026-27783Medium· 4.3Gitea: Missing repository-unit authorization on issue-template API endpoints
Gitea: Missing repository-unit authorization on issue-template API endpoints
CVE-2026-20706MediumGitea: Token scope bypass on web archive download endpoint
Gitea: Token scope bypass on web archive download endpoint