Security: go-gitea/gitea
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot accessGHSA-xv9x-fj9g-vj6h published
Jul 13, 2026 by bircniModerate -
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization settingGHSA-m6qc-j894-7h9r published
Jul 13, 2026 by bircniHigh -
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)GHSA-66m4-5jjr-2rg5 published
Jul 13, 2026 by bircniModerate -
CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`GHSA-qf2f-qh6p-7v89 published
Jul 13, 2026 by bircniModerate -
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURLGHSA-xmj7-xj85-hfc3 published
Jul 13, 2026 by bircniModerate -
Repository migration SSRF via multi-answer DNS allow-list bypassGHSA-h2x6-g7q6-344v published
Jul 13, 2026 by bircniModerate -
Public-only repository tokens can update private PR head branchesGHSA-xxjv-752h-3vp2 published
Jul 13, 2026 by bircniCritical -
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contentsGHSA-cp3q-vrj2-ghhh published
Jul 13, 2026 by bircniModerate -
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145GHSA-prr9-9mp4-5gp2 published
Jul 13, 2026 by bircniModerate -
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APIGHSA-pgqf-926r-548m published
Jul 13, 2026 by bircniLow