Gitea has 167 CVEs on record between 2024 and 2026. Disclosure cadence is accelerating: 99 in the last 90 days against 53 in the 90 before. The busiest recent month was October 2026 with 78. The median CVSS is 6.5 (medium), with 14 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-863 (43) and CWE-284 (21). Most affected products: code.gitea.io/gitea (69), Gitea (52), gitea.dev (43).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 99 prev 53
Weakness classes
Products
- code.gitea.io/gitea 69
- Gitea 52
- gitea.dev 43
- Gitea Open Source Git Server 1
- gitea.com/gitea/runner 1
- gitea/gitea 1
Worst active — by depth score
CVE-2026-60004Critical· 9.8Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.84CVE-2024-6886Critical· 10.0Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.74CVE-2026-59774Critical· 9.8Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files72CVE-2026-58424High· 8.9Gitea: Permanent Fork PR Workflow Approval Gate Bypass61CVE-2026-73804High· 8.1Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account57
Gitea vulnerabilities
CVEs affecting Gitea, newest first. Open any entry for full detail, references, and exploit status.
167 CVEsRSS
CVE-2026-27783Medium· 4.3Gitea: Missing repository-unit authorization on issue-template API endpoints
Gitea: Missing repository-unit authorization on issue-template API endpoints
CVE-2026-20706MediumGitea: Token scope bypass on web archive download endpoint
Gitea: Token scope bypass on web archive download endpoint
CVE-2026-20736High· 7.5Gitea does not properly verify repository context when deleting attachments
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a dif…
CVE-2026-20912Critical· 9.1Gitea does not properly validate repository ownership when linking attachments to releases
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to…
CVE-2026-20897Critical· 9.1Gitea does not properly validate repository ownership when deleting Git LFS locks
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
CVE-2026-20750Critical· 9.1Gitea does not properly validate project ownership in organization project operations
Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.
CVE-2025-69413Medium· 5.3PoCIn Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
CVE-2025-68946Medium· 5.4In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
CVE-2025-68945Medium· 5.8In Gitea before 1.21.2, an anonymous user can visit a private user's project.
In Gitea before 1.21.2, an anonymous user can visit a private user's project.
CVE-2025-68944Medium· 5.0Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
CVE-2025-68943Medium· 5.3Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.
Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.
CVE-2025-68942Medium· 5.4Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.
Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.
CVE-2025-68941Medium· 4.9Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.
Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.
CVE-2025-68940Low· 3.1In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.
In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.
CVE-2025-68938Medium· 4.3Gitea before 1.25.2 mishandles authorization for deletion of releases.
Gitea before 1.25.2 mishandles authorization for deletion of releases.
CVE-2025-68939High· 8.2Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
CVE-2024-6886Critical· 10.0PoCImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.