Gitea
Vulnerability activity for Gitea: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 365 days
- CVEs
- 36
- Critical (CVSS 9+)
- 10
- Exploited (CISA KEV)
- 1
- With exploit code
- 3
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
Recent
- 4.3MediumOct 18, 2026Gitea Auth bypass / access controlCVE-2026-107686The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed.
- 8.1HighOct 18, 2026Gitea CSRFCVE-2026-107618`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.
- 9.8CriticalAug 25, 2026Gitea Code / command injectionCVE-2026-60004Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.Exploited24% likelyExploit codeNucleiDetection
- 8.1HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-28744Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.
- 7.1HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-28740Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.
- 8.7HighJul 3, 2026Gitea Open Source Git Server XSSCVE-2026-28737Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.
- 5.3MediumJul 3, 2026Gitea Open Source Git Server Path traversal / file handlingCVE-2026-28705Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.
- 8.1HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-28699Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.
- 4.3MediumJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-27783Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.
- 9.8CriticalJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-27780Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.
- 7.5HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-27779Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.
- 8.8HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-27775Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.
- 8.2HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-27771Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.1.4% likelyNucleiDetection
- 4.3MediumJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-27761Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.
- 7.5HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-27660Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.
- 7.5HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-27657Gitea versions before 1.25.5 allow a user to change another user's primary email address.
- 7.5HighJul 3, 2026Gitea Open Source Git Server Denial of serviceCVE-2026-26307Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.
- 9.8CriticalJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-26292Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
- 9.1CriticalJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-26247Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
- 9.1CriticalJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-26232Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.
- 8.5HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-26231Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.
- 5.3MediumJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-25782Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.
- 6.1MediumJul 3, 2026Gitea Open Source Git ServerCVE-2026-25779Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.
- 9.1CriticalJul 3, 2026Gitea Open Source Git Server Path traversal / file handlingCVE-2026-25718Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.
- 4.3MediumJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-25714Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.
- 7.5HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-25712Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
- 7.5HighJul 3, 2026Gitea Open Source Git Server Information disclosureCVE-2026-25038Gitea 1.26.2 allows unauthorized users to access labels of private organizations.
- 7.5HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-24690Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.
- 7.5HighJul 3, 2026Gitea Open Source Git Server Information disclosureCVE-2026-24451Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.
- 9.6CriticalJul 3, 2026Gitea Open Source Git Server SSRFCVE-2026-22874Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.
- 8.1HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-22555Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.
- 9.1CriticalJul 3, 2026Gitea Open Source Git ServerCVE-2026-22547Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.
- 5.3MediumJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-20909Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.
- 7.1HighJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-20779Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.
- 9.1CriticalJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-20706Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.
- 9.8CriticalJul 3, 2026Gitea Open Source Git Server Auth bypass / access controlCVE-2026-20896Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.2.8% likelyExploit codeNucleiDetection
Top products
- Gitea Open Source Git Server33 CVEs in the last year, 9 critical
- Gitea3 CVEs in the last year, 1 critical, 1 exploited
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Oct 20, 2026Gitea security advisory (AV26-845) - Update 1CVE-2026-20896CVE-2026-60004
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.