Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
194 vulnerabilities found for Gitea Open Source Git Server by Gitea
CVE-2026-59765 (GCVE-0-2026-59765)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
Summary
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "tikket1"
},
{
"lang": "en",
"type": "reporter",
"value": "theluckystrike"
},
{
"lang": "en",
"type": "reporter",
"value": "Letian-aarch64"
},
{
"lang": "en",
"type": "reporter",
"value": "JebeenLee"
},
{
"lang": "en",
"type": "reporter",
"value": "JLLeitschuh"
},
{
"lang": "en",
"type": "reporter",
"value": "pick"
},
{
"lang": "en",
"type": "reporter",
"value": "noobx123"
},
{
"lang": "en",
"type": "coordinator",
"value": "kdalal-vulncheck"
}
],
"descriptions": [
{
"lang": "en",
"value": "SSRF via Migration Asset Downloads Bypasses hostmatcher \u2014 Reads Internal Files and Cloud Metadata"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:59.148Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "SSRF via Migration Asset Downloads Bypasses hostmatcher \u2014 Reads Internal Files and Cloud Metadata",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-59765",
"datePublished": "2026-08-13T16:44:59.148Z",
"dateReserved": "2026-07-08T09:19:07.995Z",
"dateUpdated": "2026-08-13T16:44:59.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59763 (GCVE-0-2026-59763)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 18:49
VLAI
EPSS
VEX
Title
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Summary
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 18:49 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-59763",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T18:49:35.272039Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T18:49:48.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "kkkh1"
}
],
"descriptions": [
{
"lang": "en",
"value": "Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:58.792Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-59763",
"datePublished": "2026-08-13T16:44:58.792Z",
"dateReserved": "2026-07-08T09:19:07.151Z",
"dateUpdated": "2026-08-13T18:49:48.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58511 (GCVE-0-2026-58511)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 18:50
VLAI
EPSS
VEX
Title
Webhook Authorization Header Returned in Plaintext via API
Summary
Webhook Authorization Header Returned in Plaintext via API
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 18:50 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-58511",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T18:50:36.100527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T18:50:39.280Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-3r5c-2xxx-h872"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "theluckystrike"
},
{
"lang": "en",
"type": "reporter",
"value": "APhuongKMA"
}
],
"descriptions": [
{
"lang": "en",
"value": "Webhook Authorization Header Returned in Plaintext via API"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:58.442Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-3r5c-2xxx-h872"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Webhook Authorization Header Returned in Plaintext via API",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58511",
"datePublished": "2026-08-13T16:44:58.442Z",
"dateReserved": "2026-07-08T09:19:07.157Z",
"dateUpdated": "2026-08-13T18:50:39.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58510 (GCVE-0-2026-58510)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 19:14
VLAI
EPSS
VEX
Title
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
Summary
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 19:13 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-58510",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T19:13:29.294919Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T19:14:00.411Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "eddieran"
}
],
"descriptions": [
{
"lang": "en",
"value": "GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path \u2014 sister code path retains stale watches on public-\u003eprivate"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-281",
"description": "CWE-281",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-359",
"description": "CWE-359",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:58.092Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-q423-49rw-g9mh"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path \u2014 sister code path retains stale watches on public-\u003eprivate",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58510",
"datePublished": "2026-08-13T16:44:58.092Z",
"dateReserved": "2026-07-08T09:19:08.744Z",
"dateUpdated": "2026-08-13T19:14:00.411Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58508 (GCVE-0-2026-58508)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
Summary
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "AmerMrkaljevic"
}
],
"descriptions": [
{
"lang": "en",
"value": "Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:57.726Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-j72v-mjr6-3424"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58508",
"datePublished": "2026-08-13T16:44:57.726Z",
"dateReserved": "2026-07-08T09:19:08.751Z",
"dateUpdated": "2026-08-13T16:44:57.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58507 (GCVE-0-2026-58507)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Private Repository Existence Disclosure via go-get Meta Endpoint
Summary
Private Repository Existence Disclosure via go-get Meta Endpoint
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "prakhar0x01"
}
],
"descriptions": [
{
"lang": "en",
"value": "Private Repository Existence Disclosure via go-get Meta Endpoint"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:57.367Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-p4mj-98mv-xq26"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Private Repository Existence Disclosure via go-get Meta Endpoint",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58507",
"datePublished": "2026-08-13T16:44:57.367Z",
"dateReserved": "2026-07-08T09:19:07.142Z",
"dateUpdated": "2026-08-13T16:44:57.367Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58445 (GCVE-0-2026-58445)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
Summary
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
Severity
No CVSS data available.
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CassianStarck"
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "CWE-203",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:56.978Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-pgqf-926r-548m"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58445",
"datePublished": "2026-08-13T16:44:56.978Z",
"dateReserved": "2026-06-30T18:57:20.616Z",
"dateUpdated": "2026-08-13T16:44:56.978Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58444 (GCVE-0-2026-58444)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Summary
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , < 1.27.0
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThan": "1.27.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "StarPlatinu"
}
],
"descriptions": [
{
"lang": "en",
"value": "Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:56.429Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-cp3q-vrj2-ghhh"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58444",
"datePublished": "2026-08-13T16:44:56.429Z",
"dateReserved": "2026-06-30T18:57:20.616Z",
"dateUpdated": "2026-08-13T16:44:56.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58443 (GCVE-0-2026-58443)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Public-only repository tokens can update private PR head branches
Summary
Public-only repository tokens can update private PR head branches
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ohxorud-dev"
},
{
"lang": "en",
"type": "remediation developer",
"value": "bircni"
},
{
"lang": "en",
"type": "remediation developer",
"value": "wxiaoguang"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "delvh"
}
],
"descriptions": [
{
"lang": "en",
"value": "Public-only repository tokens can update private PR head branches"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:55.935Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-xxjv-752h-3vp2"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Public-only repository tokens can update private PR head branches",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58443",
"datePublished": "2026-08-13T16:44:55.935Z",
"dateReserved": "2026-06-30T18:57:20.616Z",
"dateUpdated": "2026-08-13T16:44:55.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58442 (GCVE-0-2026-58442)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Repository migration SSRF via multi-answer DNS allow-list bypass
Summary
Repository migration SSRF via multi-answer DNS allow-list bypass
Severity
No CVSS data available.
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Tomer-PL"
}
],
"descriptions": [
{
"lang": "en",
"value": "Repository migration SSRF via multi-answer DNS allow-list bypass"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:55.444Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-h2x6-g7q6-344v"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Repository migration SSRF via multi-answer DNS allow-list bypass",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58442",
"datePublished": "2026-08-13T16:44:55.444Z",
"dateReserved": "2026-06-30T18:57:20.616Z",
"dateUpdated": "2026-08-13T16:44:55.444Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58441 (GCVE-0-2026-58441)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
Summary
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yoojoon2"
}
],
"descriptions": [
{
"lang": "en",
"value": "SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:54.967Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-xmj7-xj85-hfc3"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58441",
"datePublished": "2026-08-13T16:44:54.967Z",
"dateReserved": "2026-06-30T18:57:20.616Z",
"dateUpdated": "2026-08-13T16:44:54.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58440 (GCVE-0-2026-58440)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Summary
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "sec-reex"
}
],
"descriptions": [
{
"lang": "en",
"value": "Webhooks created by a collaborator keep firing after their repo access is revoked \u2192 ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:54.496Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-66m4-5jjr-2rg5"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Webhooks created by a collaborator keep firing after their repo access is revoked \u2192 ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58440",
"datePublished": "2026-08-13T16:44:54.496Z",
"dateReserved": "2026-06-30T18:57:20.616Z",
"dateUpdated": "2026-08-13T16:44:54.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58439 (GCVE-0-2026-58439)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Summary
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yonatan-pl"
}
],
"descriptions": [
{
"lang": "en",
"value": "Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:53.887Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-w5pg-649r-p6gg"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58439",
"datePublished": "2026-08-13T16:44:53.887Z",
"dateReserved": "2026-06-30T18:57:20.616Z",
"dateUpdated": "2026-08-13T16:44:53.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58438 (GCVE-0-2026-58438)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Summary
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "de3erve"
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:53.141Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-xv9x-fj9g-vj6h"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58438",
"datePublished": "2026-08-13T16:44:53.141Z",
"dateReserved": "2026-06-30T18:57:20.616Z",
"dateUpdated": "2026-08-13T16:44:53.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58437 (GCVE-0-2026-58437)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Repository Visibility Manipulation via Git Push Options
Summary
Repository Visibility Manipulation via Git Push Options
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "prakhar0x01"
}
],
"descriptions": [
{
"lang": "en",
"value": "Repository Visibility Manipulation via Git Push Options"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:52.661Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8p9h-49rc-qgxj"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Repository Visibility Manipulation via Git Push Options",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58437",
"datePublished": "2026-08-13T16:44:52.661Z",
"dateReserved": "2026-06-30T18:57:20.616Z",
"dateUpdated": "2026-08-13T16:44:52.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58436 (GCVE-0-2026-58436)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Summary
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Severity
No CVSS data available.
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "tonghuaroot"
}
],
"descriptions": [
{
"lang": "en",
"value": "ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:52.210Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-fw57-jgch-pgf3"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58436",
"datePublished": "2026-08-13T16:44:52.210Z",
"dateReserved": "2026-06-30T18:57:20.616Z",
"dateUpdated": "2026-08-13T16:44:52.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58435 (GCVE-0-2026-58435)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Gitea LFS Deploy-Key Privilege Escalation
Summary
Gitea LFS Deploy-Key Privilege Escalation
Severity
No CVSS data available.
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "adrian-doyensec"
}
],
"descriptions": [
{
"lang": "en",
"value": "Gitea LFS Deploy-Key Privilege Escalation"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:51.733Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rh79-75qm-gwjr"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Gitea LFS Deploy-Key Privilege Escalation",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58435",
"datePublished": "2026-08-13T16:44:51.733Z",
"dateReserved": "2026-06-30T18:57:20.616Z",
"dateUpdated": "2026-08-13T16:44:51.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58434 (GCVE-0-2026-58434)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Private Repository Metadata Remains Accessible After Access Revocation
Summary
Private Repository Metadata Remains Accessible After Access Revocation
Severity
No CVSS data available.
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
1.26.2
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"status": "affected",
"version": "1.26.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ybsun0215"
}
],
"descriptions": [
{
"lang": "en",
"value": "Private Repository Metadata Remains Accessible After Access Revocation"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:51.261Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-j2w3-9c3r-g83q"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Private Repository Metadata Remains Accessible After Access Revocation",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58434",
"datePublished": "2026-08-13T16:44:51.261Z",
"dateReserved": "2026-06-30T18:57:20.615Z",
"dateUpdated": "2026-08-13T16:44:51.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58433 (GCVE-0-2026-58433)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Summary
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "de3erve"
}
],
"descriptions": [
{
"lang": "en",
"value": "Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:50.794Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-m6qc-j894-7h9r"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58433",
"datePublished": "2026-08-13T16:44:50.794Z",
"dateReserved": "2026-06-30T18:57:20.615Z",
"dateUpdated": "2026-08-13T16:44:50.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58432 (GCVE-0-2026-58432)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Summary
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Severity
No CVSS data available.
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "z3r0s6"
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:50.340Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-q9pg-jj6x-j9p6"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58432",
"datePublished": "2026-08-13T16:44:50.340Z",
"dateReserved": "2026-06-30T18:57:20.615Z",
"dateUpdated": "2026-08-13T16:44:50.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58431 (GCVE-0-2026-58431)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Public-only API token restriction is not enforced on team API routes
Summary
Public-only API token restriction is not enforced on team API routes
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "rmb122"
}
],
"descriptions": [
{
"lang": "en",
"value": "Public-only API token restriction is not enforced on team API routes"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:49.923Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-h56g-4qw7-2mxg"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Public-only API token restriction is not enforced on team API routes",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58431",
"datePublished": "2026-08-13T16:44:49.923Z",
"dateReserved": "2026-06-30T18:57:20.615Z",
"dateUpdated": "2026-08-13T16:44:49.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58429 (GCVE-0-2026-58429)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Summary
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Severity
No CVSS data available.
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Pcat2003"
}
],
"descriptions": [
{
"lang": "en",
"value": "Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1259",
"description": "CWE-1259",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:49.484Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-fq2p-5p22-8g6j"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58429",
"datePublished": "2026-08-13T16:44:49.484Z",
"dateReserved": "2026-06-30T18:57:20.615Z",
"dateUpdated": "2026-08-13T16:44:49.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58428 (GCVE-0-2026-58428)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Summary
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Severity
No CVSS data available.
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "bl4cksku11"
}
],
"descriptions": [
{
"lang": "en",
"value": "Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "CWE-424",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:49.015Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-25gq-j9jx-43pg"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58428",
"datePublished": "2026-08-13T16:44:49.015Z",
"dateReserved": "2026-06-30T18:57:20.615Z",
"dateUpdated": "2026-08-13T16:44:49.015Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58427 (GCVE-0-2026-58427)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Summary
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Severity
No CVSS data available.
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Razzlemouse"
}
],
"descriptions": [
{
"lang": "en",
"value": "Private org member list leaked via /members API endpoint \u2014 incomplete fix for PR #38145"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:48.425Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-prr9-9mp4-5gp2"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Private org member list leaked via /members API endpoint \u2014 incomplete fix for PR #38145",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58427",
"datePublished": "2026-08-13T16:44:48.425Z",
"dateReserved": "2026-06-30T18:57:20.615Z",
"dateUpdated": "2026-08-13T16:44:48.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58425 (GCVE-0-2026-58425)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
Summary
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
Severity
No CVSS data available.
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "bl4cksku11"
}
],
"descriptions": [
{
"lang": "en",
"value": "OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:47.902Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-vxv2-8j6r-pcpg"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58425",
"datePublished": "2026-08-13T16:44:47.902Z",
"dateReserved": "2026-06-30T18:57:20.614Z",
"dateUpdated": "2026-08-13T16:44:47.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58420 (GCVE-0-2026-58420)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Local File Inclusion via file:// URI in Migration Restore
Summary
Local File Inclusion via file:// URI in Migration Restore
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "isa0-gh"
},
{
"lang": "en",
"type": "analyst",
"value": "ibrahmsql"
}
],
"descriptions": [
{
"lang": "en",
"value": "Local File Inclusion via file:// URI in Migration Restore"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:47.452Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-5ggr-2f2h-jmvm"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Local File Inclusion via file:// URI in Migration Restore",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58420",
"datePublished": "2026-08-13T16:44:47.452Z",
"dateReserved": "2026-06-30T18:57:20.614Z",
"dateUpdated": "2026-08-13T16:44:47.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58417 (GCVE-0-2026-58417)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
REST API exposes organization membership of private organizations to public
Summary
REST API exposes organization membership of private organizations to public
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "maluff"
},
{
"lang": "en",
"type": "reporter",
"value": "Sai2r"
},
{
"lang": "en",
"type": "reporter",
"value": "mgelde"
}
],
"descriptions": [
{
"lang": "en",
"value": "REST API exposes organization membership of private organizations to public"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:47.004Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-jr5x-6h83-wrxf"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "REST API exposes organization membership of private organizations to public",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58417",
"datePublished": "2026-08-13T16:44:47.004Z",
"dateReserved": "2026-06-30T18:57:20.613Z",
"dateUpdated": "2026-08-13T16:44:47.004Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58416 (GCVE-0-2026-58416)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 18:37
VLAI
EPSS
VEX
Title
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Summary
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 18:37 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-58416",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T18:37:37.811090Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T18:37:50.990Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CassianStarck"
}
],
"descriptions": [
{
"lang": "en",
"value": "Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-280",
"description": "CWE-280",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:46.534Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-fj8v-hjwv-qm88"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58416",
"datePublished": "2026-08-13T16:44:46.534Z",
"dateReserved": "2026-06-30T18:57:20.613Z",
"dateUpdated": "2026-08-13T18:37:50.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58314 (GCVE-0-2026-58314)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44
VLAI
EPSS
VEX
Title
Two SSRF findings in Gitea 1.26.2
Summary
Two SSRF findings in Gitea 1.26.2
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xclow3n"
}
],
"descriptions": [
{
"lang": "en",
"value": "Two SSRF findings in Gitea 1.26.2"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:46.109Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-2fcr-jfvc-vgg2"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Two SSRF findings in Gitea 1.26.2",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-58314",
"datePublished": "2026-08-13T16:44:46.109Z",
"dateReserved": "2026-07-08T09:19:08.772Z",
"dateUpdated": "2026-08-13T16:44:46.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57897 (GCVE-0-2026-57897)
Vulnerability from nvd – Published: 2026-08-13 16:44 – Updated: 2026-08-13 18:38
VLAI
EPSS
VEX
Title
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Summary
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 18:38 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.0 | release-notes |
| https://blog.gitea.com/gitea-1.27.0-is-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-57897",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T18:38:37.540266Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T18:38:41.211Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gitea Open Source Git Server",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "prakhar0x01"
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T16:44:45.669Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-frpw-3h2q-4jj6"
},
{
"name": "Gitea v1.27.0 Release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
},
{
"name": "Gitea v1.27.0 Release Blog Post",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
}
],
"title": "Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-57897",
"datePublished": "2026-08-13T16:44:45.669Z",
"dateReserved": "2026-07-08T09:19:07.139Z",
"dateUpdated": "2026-08-13T18:38:41.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}