Security: go-gitea/gitea
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation RestrictionsGHSA-rjvx-x5h2-6px5 published
Jun 21, 2026 by bircniHigh -
Local File Inclusion via file:// URI in Migration RestoreGHSA-5ggr-2f2h-jmvm published
Jul 13, 2026 by bircniModerate -
Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository WriteGHSA-649p-mmhf-85c7 published
Jun 21, 2026 by bircniHigh -
Gitea LFS Deploy-Key Privilege EscalationGHSA-rh79-75qm-gwjr published
Jul 13, 2026 by bircniHigh -
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)GHSA-vrhc-jjfc-m3m3 published
Jul 13, 2026 by bircniHigh -
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118GHSA-7p4h-3gxq-x3h3 published
Jul 13, 2026 by bircniModerate -
Git LFS object reuse allows non-Code access to authorize private source objectsGHSA-2m9v-5q2g-58vq published
Jun 21, 2026 by bircniHigh -
Privilege Escalation via Access Token Scope Escalation in APIGHSA-683j-3ff6-hh2x published
Jul 13, 2026 by bircniModerate -
Public-only API token restriction is not enforced on team API routesGHSA-h56g-4qw7-2mxg published
Jul 13, 2026 by bircniModerate -
Gitea SSH Key Parser Denial of ServiceGHSA-4xjf-493q-98p3 published
Jul 13, 2026 by bircniModerate