gitea.dev

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) ### Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform **no token-scope or public-only enforcement**. A…

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override Summary Gitea's internal API HTTP client (modules/private/internal.go) hardcodes TLSClientConfig.InsecureSkipVerify = true with no configuration ov…

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 ## Summary After [PR #37118](https://github.com/go-gitea/gitea/pull/37118) / **CVE-2026-…

Gitea: Privilege Escalation via Access Token Scope Escalation in API Gitea's API endpoint for creating Personal Access Tokens (`POST /users/{username}/tokens`) is protected by a middleware (`reqBasicOrRevProxyAuth`) that is intended to re…

Gitea SSH Key Parser Denial of Service Gitea's SSH key ingestion endpoint accepts keys in RFC 4716 (SSH2) format and normalises them before storage. The normalisation function contains an O(N²) string concatenation loop with no input siz…

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload Gitea's Debian package registry parser contains an unbounded decompression vulnerability in [ParseControlFile](https://github.com/…

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content ## Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the …

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration # Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal G…

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs **Author:** Prakhar Porwal **Date:** 2026-05-24 **Target:** Gitea (self-hosted Git service) **Branch tested:** `main` @ `b7e95cc48c` (development build, go1.26.3)…

Gitea: Two SSRF findings | --- | --- | | Versions tested | `gitea/gitea:1.26.2` (digest `sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031`); `gitea/gitea:latest` resolves to the same digest at time of writing | | So…

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) ### Summary `GetActionsUserRepoPermission` (`models/perm/access/repo_permission.go`) decides whether an Actions ta…

Gitea: REST API exposes organization membership of private organizations to public ### Summary The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organization. ### …

Gitea: Local File Inclusion via file:// URI in Migration Restore # Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/gitea_uploader.go, modules/uri/uri.go Severity: High Affec…

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 ## Summary PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members (n…

Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) ## Summary The web handler `EditReleasePost` (`routers/web/repo/release.go`) reads form fields with prefix `attachment-edit-{uuid}…

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints ### Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization …

Gitea: Public-only API token restriction is not enforced on team API routes ### Summary Gitea's `/api/v1/teams/{id}` API routes do not correctly enforce the `public-only` access token restriction. A `public-only` token is intended to li…

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests ### Summary The Locale middleware that runs in front of every unauthenticated request calls `golang.org/x/text/language.ParseAcceptLanguage` …

Gitea: Repository Visibility Manipulation via Git Push Options ### Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | **Affected File** | `routers/private/hook_post_receive.go` | | **Affected Fu…

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access ### Details `RemoveDependency` in `routers/web/repo/issue_dependency.go` takes a `removeDependencyID` fo…

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content ## Affected product Gitea — `services/repository/collaboration.go` (`DeleteCollaboration…

Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents ### Summary A personal access token (PAT) or OAuth2 token that does **not** carry the `reposit…

Gitea: Webhook Authorization Header Returned in Plaintext via API ## Summary The `ToHook()` function in `services/webhook/general.go` decrypts the webhook's `HeaderAuthorizationEncrypted` field and returns the plaintext authorization hea…

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads ## Summary Hello Gitea Security Team, Thank you for your continued work on Gitea. I would like to responsibly report a potential avail…

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata ### Summary Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, which valida…