Security: go-gitea/gitea
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
User-scoped tokens can mint unscoped HTTP signature API credentialsGHSA-q55v-4cmj-xh65 published
Aug 14, 2026 by bircniHigh -
gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabledGHSA-x4q3-gcj3-m6cf published
Aug 15, 2026 by bircniCritical -
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contentsGHSA-cp3q-vrj2-ghhh published
Jul 13, 2026 by bircniModerate -
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145GHSA-prr9-9mp4-5gp2 published
Jul 13, 2026 by bircniModerate -
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APIGHSA-pgqf-926r-548m published
Jul 13, 2026 by bircniLow -
Denial of Service via Unbounded io.ReadAll in NPM Package Tag EndpointGHSA-wwqq-x6w4-frm2 published
Jul 13, 2026 by bircniModerate -
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)GHSA-fj8v-hjwv-qm88 published
Jul 13, 2026 by bircniModerate -
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)GHSA-6cqf-375w-639g published
Jul 13, 2026 by bircniModerate -
REST API exposes organization membership of private organizations to publicGHSA-jr5x-6h83-wrxf published
Jul 13, 2026 by bircniLow -
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)GHSA-94v3-77j7-vm48 published
Jul 13, 2026 by bircniHigh