gitea.dev (Go)
Advisories
56
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.27.1 or later clears every advisory below that has a fix.
Upgrade commands
go
go get gitea.dev@v1.27.1 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-rcr6-4jqh-j84m Gitea: Remote Code Execution via diffpatch Git Hook Installation Known exploited |
Critical EPSS 23.99% |
>= 1.17.0, < 1.27.1 | 1.27.1 |
| GHSA-rcr6-4jqh-j84m Gitea: Remote Code Execution via diffpatch Git Hook Installation Known exploited |
Critical EPSS 23.99% |
>= 1.17.0, < 1.27.1 | 1.27.1 |
| GHSA-rcr6-4jqh-j84m Gitea: Remote Code Execution via diffpatch Git Hook Installation Known exploited |
Critical EPSS 23.99% |
< 1.27.1 | 1.27.1 |
| GHSA-fq2p-5p22-8g6j Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints |
Medium EPSS 0.47% |
< 1.27.0 | 1.27.0 |
| GHSA-2wm4-vwp6-v7xc Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata |
High EPSS 0.39% |
< 1.27.0 | 1.27.0 |
| GHSA-2wm4-vwp6-v7xc Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata |
High EPSS 0.39% |
< 1.27.0 | 1.27.0 |
| GHSA-3r5c-2xxx-h872 Gitea: Webhook Authorization Header Returned in Plaintext via API |
Low EPSS 0.39% |
< 1.27.0 | 1.27.0 |
| GHSA-frpw-3h2q-4jj6 Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs |
Medium EPSS 0.41% |
< 1.27.0 | 1.27.0 |
| GHSA-q423-49rw-g9mh Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private |
Medium EPSS 0.33% |
< 1.27.0 | 1.27.0 |
| GHSA-h56g-4qw7-2mxg Gitea: Public-only API token restriction is not enforced on team API routes |
Medium EPSS 0.33% |
< 1.27.0 | 1.27.0 |
| GHSA-h56g-4qw7-2mxg Gitea: Public-only API token restriction is not enforced on team API routes |
Medium EPSS 0.33% |
< 1.27.0 | 1.27.0 |
| GHSA-prr9-9mp4-5gp2 Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 |
High EPSS 0.47% |
< 1.27.0 | 1.27.0 |
| GHSA-prr9-9mp4-5gp2 Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 |
High EPSS 0.47% |
< 1.27.0 | 1.27.0 |
| GHSA-2fcr-jfvc-vgg2 Gitea: Two SSRF findings |
High EPSS 0.40% |
< 1.27.0 | 1.27.0 |
| GHSA-fw57-jgch-pgf3 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests |
High EPSS 0.61% |
< 1.27.0 | 1.27.0 |
| GHSA-4xjf-493q-98p3 Gitea SSH Key Parser Denial of Service |
Medium EPSS 0.17% |
< 1.27.0 | 1.27.0 |
| GHSA-4xjf-493q-98p3 Gitea SSH Key Parser Denial of Service |
Medium EPSS 0.17% |
< 1.27.0 | 1.27.0 |
| GHSA-8p9h-49rc-qgxj Gitea: Repository Visibility Manipulation via Git Push Options |
High EPSS 0.34% |
< 1.27.0 | 1.27.0 |
| GHSA-vrhc-jjfc-m3m3 Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) |
High EPSS 0.41% |
< 1.27.0 | 1.27.0 |
| GHSA-rh79-75qm-gwjr Gitea LFS Deploy-Key Privilege Escalation |
Medium EPSS 0.29% |
< 1.27.0 | 1.27.0 |
| GHSA-5ggr-2f2h-jmvm Gitea: Local File Inclusion via file:// URI in Migration Restore |
Medium EPSS 0.47% |
< 1.27.0 | 1.27.0 |
| GHSA-5ggr-2f2h-jmvm Gitea: Local File Inclusion via file:// URI in Migration Restore |
Medium EPSS 0.47% |
< 1.27.0 | 1.27.0 |
| GHSA-m932-crvm-gcp5 Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service |
Low EPSS 0.46% |
< 1.27.0 | 1.27.0 |
| GHSA-mg4f-x9v4-6h2p Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes |
Critical EPSS 0.51% |
< 1.27.0 | 1.27.0 |
| GHSA-j2w3-9c3r-g83q Gitea: Private Repository Metadata Remains Accessible After Access Revocation |
High EPSS 0.47% |
< 1.27.0 | 1.27.0 |
| GHSA-94v3-77j7-vm48 Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override |
High EPSS 0.30% |
< 1.27.0 | 1.27.0 |
| GHSA-jr5x-6h83-wrxf Gitea: REST API exposes organization membership of private organizations to public |
High EPSS 0.47% |
< 1.27.0 | 1.27.0 |
| GHSA-jr5x-6h83-wrxf Gitea: REST API exposes organization membership of private organizations to public |
High EPSS 0.47% |
< 1.27.0 | 1.27.0 |
| GHSA-6cqf-375w-639g Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) |
Medium EPSS 0.36% |
< 1.27.0 | 1.27.0 |
| GHSA-fj8v-hjwv-qm88 Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) |
High EPSS 0.31% |
< 1.27.0 | 1.27.0 |
| GHSA-fj8v-hjwv-qm88 Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) |
High EPSS 0.31% |
< 1.27.0 | 1.27.0 |
| GHSA-wwqq-x6w4-frm2 Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint |
Medium EPSS 0.53% |
< 1.27.0 | 1.27.0 |
| GHSA-pgqf-926r-548m Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API |
Low EPSS 0.37% |
< 1.27.0 | 1.27.0 |
| GHSA-cp3q-vrj2-ghhh Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents |
Medium EPSS 0.36% |
< 1.27.0 | 1.27.0 |
| GHSA-xxjv-752h-3vp2 Gitea: Public-only repository tokens can update private PR head branches |
Critical EPSS 0.58% |
< 1.27.0 | 1.27.0 |
| GHSA-h2x6-g7q6-344v Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass |
Medium EPSS 0.43% |
< 1.27.0 | 1.27.0 |
| GHSA-xmj7-xj85-hfc3 Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL |
Medium EPSS 0.17% |
< 1.27.0 | 1.27.0 |
| GHSA-xv9x-fj9g-vj6h Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access |
High EPSS 0.47% |
< 1.27.0 | 1.27.0 |
| GHSA-xv9x-fj9g-vj6h Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access |
High EPSS 0.47% |
< 1.27.0 | 1.27.0 |
| GHSA-683j-3ff6-hh2x Gitea: Privilege Escalation via Access Token Scope Escalation in API |
Critical EPSS 0.83% |
< 1.27.0 | 1.27.0 |
| GHSA-6hm7-3pwj-22rm Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload |
Medium EPSS 0.17% |
< 1.27.0 | 1.27.0 |
| GHSA-p4mj-98mv-xq26 Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint |
Medium EPSS 0.38% |
< 1.27.0 | 1.27.0 |
| GHSA-6c6r-5xr4-cr5m Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content |
Medium EPSS 0.31% |
< 1.27.0 | 1.27.0 |
| GHSA-x77v-q46j-393g Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim |
Low EPSS 0.29% |
< 1.27.0 | 1.27.0 |
| GHSA-vxv2-8j6r-pcpg Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) |
Medium EPSS 0.33% |
< 1.27.0 | 1.27.0 |
| GHSA-9mq6-mqjj-c2c5 Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads |
Medium EPSS 0.29% |
< 1.27.0 | 1.27.0 |
| GHSA-rgv6-xp99-6mgj Gitea Remember-Me Token Theft Not Invalidating Attacker Session |
Critical EPSS 0.48% |
< 1.27.0 | 1.27.0 |
| GHSA-q9pg-jj6x-j9p6 Gitea: draft release attachment disclosure via missing web authorization |
Medium EPSS 0.43% |
< 1.27.0 | 1.27.0 |
| GHSA-25gq-j9jx-43pg Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) |
Medium EPSS 0.46% |
< 1.27.0 | 1.27.0 |
| GHSA-7p4h-3gxq-x3h3 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 |
Critical EPSS 0.53% |
< 1.27.0 | 1.27.0 |
| GHSA-7p4h-3gxq-x3h3 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 |
Critical EPSS 0.53% |
< 1.27.0 | 1.27.0 |
| GHSA-qf2f-qh6p-7v89 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` |
Medium EPSS 0.28% |
< 1.27.0 | 1.27.0 |
| GHSA-66m4-5jjr-2rg5 Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content |
Medium EPSS 0.48% |
< 1.27.0 | 1.27.0 |
| GHSA-66m4-5jjr-2rg5 Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content |
Medium EPSS 0.48% |
< 1.27.0 | 1.27.0 |
| GHSA-82f7-87hm-852x Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration |
High EPSS 0.36% |
< 1.27.0 | 1.27.0 |
| GO-2026-6029 Gitea: Git LFS object reuse allows non-Code access to authorize private source objects |
High EPSS 0.32% |
< 1.26.3 | 1.26.3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor