Security: go-gitea/gitea
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Public-Only Personal access tokens scope bypass in Organization and Permission EndpointsGHSA-fq2p-5p22-8g6j published
Jul 13, 2026 by bircniModerate -
Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repoGHSA-mm7c-rhg6-qr4r published
Jun 5, 2026 by lunnyHigh -
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval FlagGHSA-w5pg-649r-p6gg published
Jul 13, 2026 by bircniHigh -
Stored XSS via glTF `extensionsRequired` in Gitea 3D File ViewerGHSA-9cpj-qc93-vw8v published
Jun 14, 2026 by lunnyHigh -
Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flawGHSA-8629-vc8r-5p58 published
Jun 5, 2026 by lunnyModerate -
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud MetadataGHSA-2wm4-vwp6-v7xc published
Jul 13, 2026 by bircniHigh -
API Fork Missing CanCreateOrgRepo Check Allows Org Secret ExfiltrationGHSA-fhx7-m96w-mv29 published
Jun 14, 2026 by lunnyHigh -
Server-Side Request Forgery (SSRF) via OpenID Discovery - Gitea v1.25.4GHSA-9574-292w-9wmw published
Aug 25, 2026 by bircniModerate -
Open Redirect via redirect_to in GiteaGHSA-j5r2-4c8j-xc3m published
Jun 14, 2026 by lunnyModerate -
Unsecure default ssh settingsGHSA-3m6q-h5gj-7mrw published
Apr 18, 2026 by lunnyHigh