BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Gitea

Gitea Security Releases - October 2026

gitea-2026-10 Oct 1, 2026 Source: Vendor

Gitea security advisories for October 2026, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2026-25946
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

56 lines
All 56 CVEs 56 Additional recognition 0 Unclaimed only
Showing 1–50 of 56 , page 1 of 2
CVE-2026-25946 BR2026-0000-030856 Gitea unclaimed
When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated re...
Credited as https://github.com/DhiyaneshGeek
CVE-2026-25946 BR2026-0000-030857 Gitea unclaimed
When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated re...
Credited as https://github.com/neo-ai-engineer
CVE-2026-59766 BR2026-0000-030858 Gitea unclaimed
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private ...
Credited as https://github.com/sec-reex
CVE-2026-59774 BR2026-0000-030859 Gitea unclaimed
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitab...
Credited as https://github.com/xbow-security
CVE-2026-59774 BR2026-0000-030860 Gitea unclaimed
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitab...
Credited as https://github.com/gleo-xbow
CVE-2026-59774 BR2026-0000-030861 Gitea unclaimed
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitab...
Credited as https://github.com/NightRang3r
CVE-2026-60008 BR2026-0000-030862 Gitea unclaimed
Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an i...
Credited as https://github.com/yagcioglutoprak
CVE-2026-60010 BR2026-0000-030863 Gitea unclaimed
Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disable...
Credited as https://github.com/akoul
CVE-2026-60018 BR2026-0000-030864 Gitea unclaimed
Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository m...
Credited as https://github.com/PhucQuan
CVE-2026-60021 BR2026-0000-030865 Gitea unclaimed
Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations ca...
Credited as https://github.com/PhucQuan
CVE-2026-62925 BR2026-0000-030866 Gitea unclaimed
Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with pa...
Credited as https://github.com/DshtAnger
CVE-2026-63021 BR2026-0000-030867 Gitea unclaimed
Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-p...
Credited as https://github.com/DshtAnger
CVE-2026-63792 BR2026-0000-030868 Gitea unclaimed
Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can ...
Credited as https://github.com/krishna-loginsoft
CVE-2026-66849 BR2026-0000-030869 Gitea unclaimed
Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download tho...
Credited as https://github.com/Black1hp
CVE-2026-66849 BR2026-0000-030870 Gitea unclaimed
Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download tho...
Credited as https://github.com/Mon3mRT
CVE-2026-66853 BR2026-0000-030871 Gitea unclaimed
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization en...
Credited as https://github.com/Black1hp
CVE-2026-66853 BR2026-0000-030872 Gitea unclaimed
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization en...
Credited as https://github.com/Mon3mRT
CVE-2026-66874 BR2026-0000-030873 Gitea unclaimed
For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request...
Credited as https://github.com/iabdullah215
CVE-2026-66874 BR2026-0000-030874 Gitea unclaimed
For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request...
Credited as https://github.com/effabinteashfaq
CVE-2026-66877 BR2026-0000-030875 Gitea unclaimed
Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level c...
Credited as https://github.com/klydz
CVE-2026-67577 BR2026-0000-030876 Gitea unclaimed
Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activi...
Credited as https://github.com/Mon3mRT
CVE-2026-67577 BR2026-0000-030877 Gitea unclaimed
Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activi...
Credited as https://github.com/Black1hp
CVE-2026-68957 BR2026-0000-030878 Gitea unclaimed
Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue ti...
Credited as https://github.com/Mon3mRT
CVE-2026-68957 BR2026-0000-030879 Gitea unclaimed
Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue ti...
Credited as https://github.com/Black1hp
CVE-2026-68964 BR2026-0000-030880 Gitea unclaimed
Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-...
Credited as https://github.com/Mon3mRT
CVE-2026-68964 BR2026-0000-030881 Gitea unclaimed
Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-...
Credited as https://github.com/Black1hp
CVE-2026-70396 BR2026-0000-030882 Gitea unclaimed
Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth ap...
Credited as https://github.com/rexpository
CVE-2026-70396 BR2026-0000-030883 Gitea unclaimed
Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth ap...
Credited as https://github.com/ybsun0215
CVE-2026-70400 BR2026-0000-030884 Gitea unclaimed
Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a...
Credited as https://github.com/rexpository
CVE-2026-70402 BR2026-0000-030885 Gitea unclaimed
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who ca...
Credited as https://github.com/What-canIsay
CVE-2026-70406 BR2026-0000-030886 Gitea unclaimed
Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request crea...
Credited as https://github.com/qw3rtyou
CVE-2026-70406 BR2026-0000-030887 Gitea unclaimed
Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request crea...
Credited as https://github.com/ohxorud-dev
CVE-2026-70407 BR2026-0000-030888 Gitea unclaimed
Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. Fo...
Credited as https://github.com/gxy1113
CVE-2026-70407 BR2026-0000-030889 Gitea unclaimed
Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. Fo...
Credited as https://github.com/iabdullah215
CVE-2026-70407 BR2026-0000-030890 Gitea unclaimed
Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. Fo...
Credited as https://github.com/rajivraj
CVE-2026-71184 BR2026-0000-030891 Gitea unclaimed
Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review c...
Credited as https://github.com/echoesofwhoami
CVE-2026-71184 BR2026-0000-030892 Gitea unclaimed
Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review c...
Credited as https://github.com/iabdullah215
CVE-2026-71301 BR2026-0000-030893 Gitea unclaimed
Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a private repository c...
Credited as https://github.com/hexcraft-labs
CVE-2026-73126 BR2026-0000-030894 Gitea unclaimed
Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or res...
Credited as https://github.com/0xDBJ
CVE-2026-73126 BR2026-0000-030895 Gitea unclaimed
Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or res...
Credited as https://github.com/shashank420
CVE-2026-73130 BR2026-0000-030896 Gitea unclaimed
Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the refer...
Credited as https://github.com/arpitjain099
CVE-2026-73135 BR2026-0000-030897 Gitea unclaimed
Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings dis...
Credited as https://github.com/LongNguyen1708
CVE-2026-73273 BR2026-0000-030898 Gitea unclaimed
Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversi...
Credited as https://github.com/rajivraj
CVE-2026-73535 BR2026-0000-030903 Gitea unclaimed
Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is ...
Credited as https://github.com/r0hanSH
CVE-2026-73535 BR2026-0000-030904 Gitea unclaimed
Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is ...
Credited as https://github.com/cyberlanc3r
CVE-2026-73539 BR2026-0000-030905 Gitea unclaimed
Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context c...
Credited as https://github.com/DshtAnger
CVE-2026-73800 BR2026-0000-030906 Gitea unclaimed
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workf...
Credited as https://github.com/chakradhar1228
CVE-2026-73800 BR2026-0000-030907 Gitea unclaimed
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workf...
Credited as https://github.com/PhucQuan
CVE-2026-73800 BR2026-0000-030908 Gitea unclaimed
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workf...
Credited as https://github.com/YuvalMil
CVE-2026-73800 BR2026-0000-030909 Gitea unclaimed
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workf...
Credited as https://github.com/elmahy111