github.com/go-gitea/gitea (Go)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 1.26.0 or later clears every advisory below that has a fix.

Upgrade commands

go get github.com/go-gitea/gitea@v1.26.0 && go mod tidy

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GO-2026-5448 Gitea: Open Redirect via redirect_to	Medium EPSS 0.30%	`< 1.26.0`	`1.26.0`
GO-2026-4364 Gitea does not properly validate repository ownership when linking attachments to releases	Critical EPSS 0.46%	`< 1.25.4`	`1.25.4`
GO-2026-4369 Gitea does not properly validate ownership when toggling OpenID URI visibility	Medium EPSS 0.30%	`< 1.25.4`	`1.25.4`
GO-2026-4363 Gitea does not properly validate repository ownership when deleting Git LFS locks	Critical EPSS 0.46%	`< 1.25.4`	`1.25.4`
GO-2026-4366 Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface	Medium EPSS 0.33%	`< 1.25.4`	`1.25.4`
GO-2026-4368 Gitea improperly exposes issue titles and repository names through previously started stopwatches	Medium EPSS 0.36%	`< 1.25.4`	`1.25.4`
GO-2026-4362 Gitea improperly exposes issue and pull request titles	Medium EPSS 0.41%	`< 1.25.4`	`1.25.4`
GO-2026-4370 Gitea does not properly validate project ownership in organization project operations	Critical EPSS 0.43%	`< 1.25.4`	`1.25.4`
GO-2024-2757 Buffer Overflow in gitea	High EPSS 1.81%	`>= 1.9.0, < 1.13.2`	`1.13.2`
GO-2022-1065 Gitea vulnerable to Argument Injection	Critical EPSS 1.40%	`< 1.17.3`	`1.17.3`
GO-2022-0830 Denial of Service in Gitea	High EPSS 1.99%	`< 1.12.0`	`1.12.0`
GO-2022-0310 Capture-replay in Gitea	Critical EPSS 2.14%	`< 1.11.2`	`1.11.2`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor