gitea.dev vulnerabilities
CVEs whose affected-version data names the gitea.dev package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
33 CVEsRSS
CVE-2026-58438LowGitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
▾ Sunlitgitea.dev · gitea.devEPSS 0.47%via GHSA
CVE-2026-58416Medium· 6.3Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
▾ Sunlitgitea.dev · gitea.devEPSS 0.31%via GHSA
CVE-2026-58417MediumGitea: REST API exposes organization membership of private organizations to public
Gitea: REST API exposes organization membership of private organizations to public
▾ Sunlitgitea.dev · gitea.devEPSS 0.47%via GHSA