Search
Find a vulnerability
Search criteria
442 vulnerabilities by Gitea
CVE-2026-97859 (GCVE-0-2026-97859)
Vulnerability from nvd – Published: 2026-10-18 19:01 – Updated: 2026-10-19 18:54
VLAI
EPSS
VEX
Title
Gitea API disclosure of private user social graph, keys and stars
Summary
Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target user. An authenticated user could therefore read the followers, following list, starred and watched repositories and public SSH and GPG keys of a user with limited or private visibility, whom they could not otherwise see. The issue was fixed in 1.27.3 and 28.0.0 and disclosed with 28.2.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 18:54 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39004 | patch |
| https://github.com/go-gitea/gitea/pull/39039 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-97859",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T18:54:24.078740Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:54:32.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.27.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/lukegranto23"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/KadirArslan"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/DshtAnger"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/DevNoScope"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/gigioneggiando"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/manus-pi"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target user. An authenticated user could therefore read the followers, following list, starred and watched repositories and public SSH and GPG keys of a user with limited or private visibility, whom they could not otherwise see. The issue was fixed in 1.27.3 and 28.0.0 and disclosed with 28.2.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T19:01:04.328Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-xvfh-qwmh-f92w",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-xvfh-qwmh-f92w"
},
{
"name": "Fix: go-gitea/gitea pull request #39004",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39004"
},
{
"name": "Fix backport to release/v1.27: go-gitea/gitea pull request #39039",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39039"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea API disclosure of private user social graph, keys and stars"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-97859",
"datePublished": "2026-10-18T19:01:04.328Z",
"dateReserved": "2026-10-04T22:02:04.898Z",
"dateUpdated": "2026-10-19T18:54:32.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97204 (GCVE-0-2026-97204)
Vulnerability from nvd – Published: 2026-10-18 19:00 – Updated: 2026-10-19 20:18
VLAI
EPSS
VEX
Title
Gitea label deletion across repository and organization IDs
Summary
Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:18 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39743 | patch |
| https://github.com/go-gitea/gitea/pull/39752 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-97204",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:18:10.857167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:18:14.773Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/N0K0"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
}
],
"descriptions": [
{
"lang": "en",
"value": "Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T19:00:50.994Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-fxq4-gr55-7x5g",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-fxq4-gr55-7x5g"
},
{
"name": "Fix: go-gitea/gitea pull request #39743",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39743"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39752",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39752"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea label deletion across repository and organization IDs"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-97204",
"datePublished": "2026-10-18T19:00:50.994Z",
"dateReserved": "2026-10-04T22:02:04.895Z",
"dateUpdated": "2026-10-19T20:18:14.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110494 (GCVE-0-2026-110494)
Vulnerability from nvd – Published: 2026-10-18 18:57 – Updated: 2026-10-19 20:20
VLAI
EPSS
VEX
Title
Gitea release attachment re-linking of issue attachments
Summary
Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size and download count of the attachment through the release and allowed the user to rename or delete it.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:20 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39839 | patch |
| https://github.com/go-gitea/gitea/pull/39847 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:20:54.281465Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:20:57.542Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/manus-pi"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size and download count of the attachment through the release and allowed the user to rename or delete it."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:57:26.290Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-cwq7-782w-pxcc",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-cwq7-782w-pxcc"
},
{
"name": "Fix: go-gitea/gitea pull request #39839",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39839"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39847",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39847"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea release attachment re-linking of issue attachments"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-110494",
"datePublished": "2026-10-18T18:57:26.290Z",
"dateReserved": "2026-10-14T20:08:45.845Z",
"dateUpdated": "2026-10-19T20:20:57.542Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110324 (GCVE-0-2026-110324)
Vulnerability from nvd – Published: 2026-10-18 18:57 – Updated: 2026-10-19 20:17
VLAI
EPSS
VEX
Title
Gitea private profile information disclosure through POST request
Summary
The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:17 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39501 | patch |
| https://github.com/go-gitea/gitea/pull/39507 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110324",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:17:29.403934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:32.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.0.0",
"status": "affected",
"version": "1.22.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "https://github.com/Yanni8"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:57:20.717Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-xmfc-hqq8-33wh",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-xmfc-hqq8-33wh"
},
{
"name": "Fix: go-gitea/gitea pull request #39501",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39501"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39507",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39507"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea private profile information disclosure through POST request"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-110324",
"datePublished": "2026-10-18T18:57:20.717Z",
"dateReserved": "2026-10-14T20:08:45.831Z",
"dateUpdated": "2026-10-19T20:17:32.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110311 (GCVE-0-2026-110311)
Vulnerability from nvd – Published: 2026-10-18 18:57 – Updated: 2026-10-19 20:17
VLAI
EPSS
VEX
Title
Gitea draft release creation disclosing attachment metadata
Summary
Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:16 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39743 | patch |
| https://github.com/go-gitea/gitea/pull/39752 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110311",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:16:47.677118Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:02.703Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "1.22.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/danielroe"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
}
],
"descriptions": [
{
"lang": "en",
"value": "Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:57:14.140Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-8j56-f865-gqq2",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8j56-f865-gqq2"
},
{
"name": "Fix: go-gitea/gitea pull request #39743",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39743"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39752",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39752"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea draft release creation disclosing attachment metadata"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-110311",
"datePublished": "2026-10-18T18:57:14.140Z",
"dateReserved": "2026-10-14T20:08:45.838Z",
"dateUpdated": "2026-10-19T20:17:02.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109844 (GCVE-0-2026-109844)
Vulnerability from nvd – Published: 2026-10-18 18:57 – Updated: 2026-10-19 20:16
VLAI
EPSS
VEX
Title
Gitea watched repositories API disclosure after access revocation
Summary
`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:16 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/38321 | patch |
| https://github.com/go-gitea/gitea/pull/38390 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-109844",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:16:26.671500Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:16:31.969Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/manus-pi"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:57:08.476Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-96gv-2xc4-4hxj",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-96gv-2xc4-4hxj"
},
{
"name": "Fix: go-gitea/gitea pull request #38321",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/38321"
},
{
"name": "Fix backport to release/v1.27: go-gitea/gitea pull request #38390",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/38390"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea watched repositories API disclosure after access revocation"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-109844",
"datePublished": "2026-10-18T18:57:08.476Z",
"dateReserved": "2026-10-14T20:08:45.827Z",
"dateUpdated": "2026-10-19T20:16:31.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109553 (GCVE-0-2026-109553)
Vulnerability from nvd – Published: 2026-10-18 18:51 – Updated: 2026-10-19 20:19
VLAI
EPSS
VEX
Title
Gitea SSH certificate principal impersonation of other users
Summary
Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:19 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39839 | patch |
| https://github.com/go-gitea/gitea/pull/39847 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-109553",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:19:01.147709Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:19:06.039Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/DshtAnger"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user\u0027s public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:51:31.037Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-vcp6-2qc6-gvq3",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-vcp6-2qc6-gvq3"
},
{
"name": "Fix: go-gitea/gitea pull request #39839",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39839"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39847",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39847"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea SSH certificate principal impersonation of other users"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-109553",
"datePublished": "2026-10-18T18:51:31.037Z",
"dateReserved": "2026-10-14T20:08:45.856Z",
"dateUpdated": "2026-10-19T20:19:06.039Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107686 (GCVE-0-2026-107686)
Vulnerability from nvd – Published: 2026-10-18 18:56 – Updated: 2026-10-19 20:15
VLAI
EPSS
VEX
Title
Gitea reactions accepted on locked issues and comments
Summary
The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:15 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39839 | patch |
| https://github.com/go-gitea/gitea/pull/39847 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-107686",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:15:54.397604Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:15:58.164Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/hariprasanth9317-tech"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:56:59.087Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-wx44-9m3m-rjqx",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-wx44-9m3m-rjqx"
},
{
"name": "Fix: go-gitea/gitea pull request #39839",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39839"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39847",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39847"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea reactions accepted on locked issues and comments"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-107686",
"datePublished": "2026-10-18T18:56:59.087Z",
"dateReserved": "2026-10-14T20:08:45.849Z",
"dateUpdated": "2026-10-19T20:15:58.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107618 (GCVE-0-2026-107618)
Vulnerability from nvd – Published: 2026-10-18 18:56 – Updated: 2026-10-18 18:56
VLAI
EPSS
VEX
Title
Gitea cross-site request forgery on repository topics
Summary
`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.
Severity
No CVSS data available.
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39839 | patch |
| https://github.com/go-gitea/gitea/pull/39847 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/bruhdev1290"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:56:53.428Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-4jmf-h2cm-hg7w",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-4jmf-h2cm-hg7w"
},
{
"name": "Fix: go-gitea/gitea pull request #39839",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39839"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39847",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39847"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea cross-site request forgery on repository topics"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-107618",
"datePublished": "2026-10-18T18:56:53.428Z",
"dateReserved": "2026-10-14T20:08:45.821Z",
"dateUpdated": "2026-10-18T18:56:53.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105964 (GCVE-0-2026-105964)
Vulnerability from nvd – Published: 2026-10-18 18:56 – Updated: 2026-10-19 20:15
VLAI
EPSS
VEX
Title
Gitea Actions artifact v4 API unbounded request body
Summary
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:15 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39818 | patch |
| https://github.com/go-gitea/gitea/pull/39822 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-105964",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:15:11.635043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:15:15.234Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "1.22.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/manus-pi"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/N0K0"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:56:47.881Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-6f9g-7jgm-m5ph",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5ph"
},
{
"name": "Fix: go-gitea/gitea pull request #39818",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39818"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39822",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39822"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea Actions artifact v4 API unbounded request body"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-105964",
"datePublished": "2026-10-18T18:56:47.881Z",
"dateReserved": "2026-10-14T20:08:45.834Z",
"dateUpdated": "2026-10-19T20:15:15.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105661 (GCVE-0-2026-105661)
Vulnerability from nvd – Published: 2026-10-18 18:56 – Updated: 2026-10-19 20:14
VLAI
EPSS
VEX
Title
Gitea panic on the repositories route of individual users
Summary
Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:14 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39839 | patch |
| https://github.com/go-gitea/gitea/pull/39847 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-105661",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:14:17.983178Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:14:33.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/kewmine"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/tienpa99"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/gemstone-source"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:56:41.198Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-c3cr-qq9g-666c",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-c3cr-qq9g-666c"
},
{
"name": "Fix: go-gitea/gitea pull request #39839",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39839"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39847",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39847"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea panic on the repositories route of individual users"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-105661",
"datePublished": "2026-10-18T18:56:41.198Z",
"dateReserved": "2026-10-14T20:08:45.842Z",
"dateUpdated": "2026-10-19T20:14:33.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104627 (GCVE-0-2026-104627)
Vulnerability from nvd – Published: 2026-10-18 18:51 – Updated: 2026-10-19 20:20
VLAI
EPSS
VEX
Title
Gitea OpenID account linking without session binding
Summary
The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:20 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39642 | patch |
| https://github.com/go-gitea/gitea/pull/39744 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104627",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:20:04.646263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:20:15.460Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/cyberlanc3r"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/u2usvc"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker\u0027s identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:51:06.543Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-mf69-7pqq-86vx",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-mf69-7pqq-86vx"
},
{
"name": "Fix: go-gitea/gitea pull request #39642",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39642"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39744",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39744"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea OpenID account linking without session binding"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-104627",
"datePublished": "2026-10-18T18:51:06.543Z",
"dateReserved": "2026-10-14T20:08:45.852Z",
"dateUpdated": "2026-10-19T20:20:15.460Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78433 (GCVE-0-2026-78433)
Vulnerability from nvd – Published: 2026-10-14 14:38 – Updated: 2026-10-18 13:35
VLAI
EPSS
VEX
Title
Gitea private attachment disclosure through repository mismatch
Summary
Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 13:35 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://blog.gitea.com/release-of-1.27.3/ | release-notes |
| https://github.com/go-gitea/gitea/pull/39048 | patch |
| https://github.com/go-gitea/gitea/pull/39077 | patch |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.3 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78433",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T13:35:32.390912Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T13:35:37.544Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.27.2",
"status": "affected",
"version": "1.26.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/iabdullah215"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
}
],
"descriptions": [
{
"lang": "en",
"value": "Gitea\u0027s web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment\u0027s UUID can request it through a public repository\u0027s attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-1220",
"description": "CWE-1220: Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:38:17.247Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-frpv-2xgv-wxpq",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-frpv-2xgv-wxpq"
},
{
"name": "Gitea 1.27.3 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-1.27.3/"
},
{
"name": "Fix: go-gitea/gitea pull request #39048",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39048"
},
{
"name": "Fix: go-gitea/gitea pull request #39077",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39077"
},
{
"name": "go-gitea/gitea v1.27.3 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.3"
}
],
"title": "Gitea private attachment disclosure through repository mismatch"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-78433",
"datePublished": "2026-10-14T14:38:17.247Z",
"dateReserved": "2026-08-24T20:45:09.297Z",
"dateUpdated": "2026-10-18T13:35:37.544Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78231 (GCVE-0-2026-78231)
Vulnerability from nvd – Published: 2026-10-14 14:38 – Updated: 2026-10-18 13:43
VLAI
EPSS
VEX
Title
Gitea blind SSRF through OpenID assertion verification
Summary
When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services reachable from the Gitea server. The response is not returned to the attacker, so the issue is blind SSRF; its impact depends on the services and network addresses the server can reach.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 13:42 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78231",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T13:42:45.487009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T13:43:09.650Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "code.gitea.io/gitea",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/alimezar"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services reachable from the Gitea server. The response is not returned to the attacker, so the issue is blind SSRF; its impact depends on the services and network addresses the server can reach."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:38:10.532Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-8vmh-w35x-73qr",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8vmh-w35x-73qr"
}
],
"title": "Gitea blind SSRF through OpenID assertion verification"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-78231",
"datePublished": "2026-10-14T14:38:10.532Z",
"dateReserved": "2026-08-24T20:45:09.301Z",
"dateUpdated": "2026-10-18T13:43:09.650Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73814 (GCVE-0-2026-73814)
Vulnerability from nvd – Published: 2026-10-14 14:38 – Updated: 2026-10-18 13:41
VLAI
EPSS
VEX
Title
Gitea repository ownership escalation by administrators
Summary
Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 13:41 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://blog.gitea.com/release-of-1.27.2/ | release-notes |
| https://github.com/go-gitea/gitea/pull/38894 | patch |
| https://github.com/go-gitea/gitea/pull/38895 | patch |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.2 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-73814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T13:41:14.726370Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T13:41:38.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.27.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/martindukek"
}
],
"descriptions": [
{
"lang": "en",
"value": "Gitea\u0027s collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266: Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:38:05.476Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-h62v-wmrr-5qjq",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-h62v-wmrr-5qjq"
},
{
"name": "Gitea 1.27.2 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-1.27.2/"
},
{
"name": "Fix: go-gitea/gitea pull request #38894",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/38894"
},
{
"name": "Fix: go-gitea/gitea pull request #38895",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/38895"
},
{
"name": "go-gitea/gitea v1.27.2 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.2"
}
],
"title": "Gitea repository ownership escalation by administrators"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-73814",
"datePublished": "2026-10-14T14:38:05.476Z",
"dateReserved": "2026-08-13T16:50:59.736Z",
"dateUpdated": "2026-10-18T13:41:38.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73804 (GCVE-0-2026-73804)
Vulnerability from nvd – Published: 2026-10-14 14:38 – Updated: 2026-10-18 13:40
VLAI
EPSS
VEX
Title
Gitea API token scope escalation through HTTP signatures
Summary
Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 13:40 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://blog.gitea.com/release-of-1.27.2/ | release-notes |
| https://github.com/go-gitea/gitea/pull/38862 | patch |
| https://github.com/go-gitea/gitea/pull/38895 | patch |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.2 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-73804",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T13:40:42.994142Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T13:40:55.669Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/ohxorud-dev"
},
{
"lang": "en",
"type": "coordinator",
"value": "https://github.com/bircni"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "https://github.com/lunny"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "https://github.com/delvh"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
},
{
"lang": "en",
"type": "coordinator",
"value": "https://github.com/TheFox0x7"
}
],
"descriptions": [
{
"lang": "en",
"value": "Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner\u0027s account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account\u0027s normal role and repository permissions."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266: Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:38:00.292Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-q55v-4cmj-xh65",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65"
},
{
"name": "Gitea 1.27.2 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-1.27.2/"
},
{
"name": "Fix: go-gitea/gitea pull request #38862",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/38862"
},
{
"name": "Fix: go-gitea/gitea pull request #38895",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/38895"
},
{
"name": "go-gitea/gitea v1.27.2 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.2"
}
],
"title": "Gitea API token scope escalation through HTTP signatures"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-73804",
"datePublished": "2026-10-14T14:38:00.292Z",
"dateReserved": "2026-08-13T16:50:59.187Z",
"dateUpdated": "2026-10-18T13:40:55.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73802 (GCVE-0-2026-73802)
Vulnerability from nvd – Published: 2026-10-14 14:37 – Updated: 2026-10-18 13:34
VLAI
EPSS
VEX
Title
Gitea Runner host isolation bypass through container options
Summary
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 13:34 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://blog.gitea.com/release-of-runner-3.0.0/ | release-notes |
| https://gitea.com/gitea/runner/releases/tag/v3.0.0 | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gitea | Gitea Runner |
Affected:
0 , < 3.0.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-73802",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T13:34:45.738812Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T13:34:49.826Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.com/gitea/runner",
"product": "Gitea Runner",
"vendor": "Gitea",
"versions": [
{
"lessThan": "3.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/sn0x-sharma"
}
],
"descriptions": [
{
"lang": "en",
"value": "Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:37:55.141Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-x4q3-gcj3-m6cf",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf"
},
{
"name": "Gitea Runner 3.0.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-runner-3.0.0/"
},
{
"name": "gitea/runner v3.0.0 release",
"tags": [
"release-notes"
],
"url": "https://gitea.com/gitea/runner/releases/tag/v3.0.0"
}
],
"title": "Gitea Runner host isolation bypass through container options"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-73802",
"datePublished": "2026-10-14T14:37:55.141Z",
"dateReserved": "2026-08-13T16:50:59.169Z",
"dateUpdated": "2026-10-18T13:34:49.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73800 (GCVE-0-2026-73800)
Vulnerability from nvd – Published: 2026-10-14 14:37 – Updated: 2026-10-18 13:33
VLAI
EPSS
VEX
Title
Gitea reusable workflow secret exposure in pull_request_target
Summary
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 13:33 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://blog.gitea.com/release-of-1.27.2/ | release-notes |
| https://github.com/go-gitea/gitea/pull/38886 | patch |
| https://github.com/go-gitea/gitea/pull/38897 | patch |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.2 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-73800",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T13:33:30.814752Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T13:33:34.382Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea/gitea",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThan": "1.27.2",
"status": "affected",
"version": "1.19.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/chakradhar1228"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/PhucQuan"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/YuvalMil"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/elmahy111"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/DshtAnger"
}
],
"descriptions": [
{
"lang": "en",
"value": "Gitea resolves local reusable workflow files from a fork\u0027s head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:37:49.783Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-r9ch-mqjm-g67v",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-r9ch-mqjm-g67v"
},
{
"name": "Gitea 1.27.2 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-1.27.2/"
},
{
"name": "Fix: go-gitea/gitea pull request #38886",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/38886"
},
{
"name": "Fix: go-gitea/gitea pull request #38897",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/38897"
},
{
"name": "go-gitea/gitea v1.27.2 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.2"
}
],
"title": "Gitea reusable workflow secret exposure in pull_request_target"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-73800",
"datePublished": "2026-10-14T14:37:49.783Z",
"dateReserved": "2026-08-13T16:50:59.749Z",
"dateUpdated": "2026-10-18T13:33:34.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97859 (GCVE-0-2026-97859)
Vulnerability from cvelistv5 – Published: 2026-10-18 19:01 – Updated: 2026-10-19 18:54
VLAI
EPSS
VEX
Title
Gitea API disclosure of private user social graph, keys and stars
Summary
Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target user. An authenticated user could therefore read the followers, following list, starred and watched repositories and public SSH and GPG keys of a user with limited or private visibility, whom they could not otherwise see. The issue was fixed in 1.27.3 and 28.0.0 and disclosed with 28.2.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 18:54 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39004 | patch |
| https://github.com/go-gitea/gitea/pull/39039 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-97859",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T18:54:24.078740Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:54:32.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.27.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/lukegranto23"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/KadirArslan"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/DshtAnger"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/DevNoScope"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/gigioneggiando"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/manus-pi"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target user. An authenticated user could therefore read the followers, following list, starred and watched repositories and public SSH and GPG keys of a user with limited or private visibility, whom they could not otherwise see. The issue was fixed in 1.27.3 and 28.0.0 and disclosed with 28.2.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T19:01:04.328Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-xvfh-qwmh-f92w",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-xvfh-qwmh-f92w"
},
{
"name": "Fix: go-gitea/gitea pull request #39004",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39004"
},
{
"name": "Fix backport to release/v1.27: go-gitea/gitea pull request #39039",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39039"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea API disclosure of private user social graph, keys and stars"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-97859",
"datePublished": "2026-10-18T19:01:04.328Z",
"dateReserved": "2026-10-04T22:02:04.898Z",
"dateUpdated": "2026-10-19T18:54:32.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97204 (GCVE-0-2026-97204)
Vulnerability from cvelistv5 – Published: 2026-10-18 19:00 – Updated: 2026-10-19 20:18
VLAI
EPSS
VEX
Title
Gitea label deletion across repository and organization IDs
Summary
Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:18 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39743 | patch |
| https://github.com/go-gitea/gitea/pull/39752 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-97204",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:18:10.857167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:18:14.773Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/N0K0"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
}
],
"descriptions": [
{
"lang": "en",
"value": "Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T19:00:50.994Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-fxq4-gr55-7x5g",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-fxq4-gr55-7x5g"
},
{
"name": "Fix: go-gitea/gitea pull request #39743",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39743"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39752",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39752"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea label deletion across repository and organization IDs"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-97204",
"datePublished": "2026-10-18T19:00:50.994Z",
"dateReserved": "2026-10-04T22:02:04.895Z",
"dateUpdated": "2026-10-19T20:18:14.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110494 (GCVE-0-2026-110494)
Vulnerability from cvelistv5 – Published: 2026-10-18 18:57 – Updated: 2026-10-19 20:20
VLAI
EPSS
VEX
Title
Gitea release attachment re-linking of issue attachments
Summary
Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size and download count of the attachment through the release and allowed the user to rename or delete it.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:20 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39839 | patch |
| https://github.com/go-gitea/gitea/pull/39847 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:20:54.281465Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:20:57.542Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/manus-pi"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size and download count of the attachment through the release and allowed the user to rename or delete it."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:57:26.290Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-cwq7-782w-pxcc",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-cwq7-782w-pxcc"
},
{
"name": "Fix: go-gitea/gitea pull request #39839",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39839"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39847",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39847"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea release attachment re-linking of issue attachments"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-110494",
"datePublished": "2026-10-18T18:57:26.290Z",
"dateReserved": "2026-10-14T20:08:45.845Z",
"dateUpdated": "2026-10-19T20:20:57.542Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110324 (GCVE-0-2026-110324)
Vulnerability from cvelistv5 – Published: 2026-10-18 18:57 – Updated: 2026-10-19 20:17
VLAI
EPSS
VEX
Title
Gitea private profile information disclosure through POST request
Summary
The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:17 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39501 | patch |
| https://github.com/go-gitea/gitea/pull/39507 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110324",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:17:29.403934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:32.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.0.0",
"status": "affected",
"version": "1.22.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "https://github.com/Yanni8"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:57:20.717Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-xmfc-hqq8-33wh",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-xmfc-hqq8-33wh"
},
{
"name": "Fix: go-gitea/gitea pull request #39501",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39501"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39507",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39507"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea private profile information disclosure through POST request"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-110324",
"datePublished": "2026-10-18T18:57:20.717Z",
"dateReserved": "2026-10-14T20:08:45.831Z",
"dateUpdated": "2026-10-19T20:17:32.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110311 (GCVE-0-2026-110311)
Vulnerability from cvelistv5 – Published: 2026-10-18 18:57 – Updated: 2026-10-19 20:17
VLAI
EPSS
VEX
Title
Gitea draft release creation disclosing attachment metadata
Summary
Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:16 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39743 | patch |
| https://github.com/go-gitea/gitea/pull/39752 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110311",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:16:47.677118Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:02.703Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "1.22.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/danielroe"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
}
],
"descriptions": [
{
"lang": "en",
"value": "Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:57:14.140Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-8j56-f865-gqq2",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8j56-f865-gqq2"
},
{
"name": "Fix: go-gitea/gitea pull request #39743",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39743"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39752",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39752"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea draft release creation disclosing attachment metadata"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-110311",
"datePublished": "2026-10-18T18:57:14.140Z",
"dateReserved": "2026-10-14T20:08:45.838Z",
"dateUpdated": "2026-10-19T20:17:02.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109844 (GCVE-0-2026-109844)
Vulnerability from cvelistv5 – Published: 2026-10-18 18:57 – Updated: 2026-10-19 20:16
VLAI
EPSS
VEX
Title
Gitea watched repositories API disclosure after access revocation
Summary
`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:16 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/38321 | patch |
| https://github.com/go-gitea/gitea/pull/38390 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-109844",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:16:26.671500Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:16:31.969Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/manus-pi"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:57:08.476Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-96gv-2xc4-4hxj",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-96gv-2xc4-4hxj"
},
{
"name": "Fix: go-gitea/gitea pull request #38321",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/38321"
},
{
"name": "Fix backport to release/v1.27: go-gitea/gitea pull request #38390",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/38390"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea watched repositories API disclosure after access revocation"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-109844",
"datePublished": "2026-10-18T18:57:08.476Z",
"dateReserved": "2026-10-14T20:08:45.827Z",
"dateUpdated": "2026-10-19T20:16:31.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107686 (GCVE-0-2026-107686)
Vulnerability from cvelistv5 – Published: 2026-10-18 18:56 – Updated: 2026-10-19 20:15
VLAI
EPSS
VEX
Title
Gitea reactions accepted on locked issues and comments
Summary
The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:15 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39839 | patch |
| https://github.com/go-gitea/gitea/pull/39847 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-107686",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:15:54.397604Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:15:58.164Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/hariprasanth9317-tech"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:56:59.087Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-wx44-9m3m-rjqx",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-wx44-9m3m-rjqx"
},
{
"name": "Fix: go-gitea/gitea pull request #39839",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39839"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39847",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39847"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea reactions accepted on locked issues and comments"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-107686",
"datePublished": "2026-10-18T18:56:59.087Z",
"dateReserved": "2026-10-14T20:08:45.849Z",
"dateUpdated": "2026-10-19T20:15:58.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107618 (GCVE-0-2026-107618)
Vulnerability from cvelistv5 – Published: 2026-10-18 18:56 – Updated: 2026-10-18 18:56
VLAI
EPSS
VEX
Title
Gitea cross-site request forgery on repository topics
Summary
`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route.
Severity
No CVSS data available.
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39839 | patch |
| https://github.com/go-gitea/gitea/pull/39847 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/bruhdev1290"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were reachable through this route."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:56:53.428Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-4jmf-h2cm-hg7w",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-4jmf-h2cm-hg7w"
},
{
"name": "Fix: go-gitea/gitea pull request #39839",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39839"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39847",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39847"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea cross-site request forgery on repository topics"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-107618",
"datePublished": "2026-10-18T18:56:53.428Z",
"dateReserved": "2026-10-14T20:08:45.821Z",
"dateUpdated": "2026-10-18T18:56:53.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105964 (GCVE-0-2026-105964)
Vulnerability from cvelistv5 – Published: 2026-10-18 18:56 – Updated: 2026-10-19 20:15
VLAI
EPSS
VEX
Title
Gitea Actions artifact v4 API unbounded request body
Summary
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:15 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39818 | patch |
| https://github.com/go-gitea/gitea/pull/39822 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-105964",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:15:11.635043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:15:15.234Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "1.22.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/manus-pi"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/N0K0"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:56:47.881Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-6f9g-7jgm-m5ph",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5ph"
},
{
"name": "Fix: go-gitea/gitea pull request #39818",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39818"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39822",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39822"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea Actions artifact v4 API unbounded request body"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-105964",
"datePublished": "2026-10-18T18:56:47.881Z",
"dateReserved": "2026-10-14T20:08:45.834Z",
"dateUpdated": "2026-10-19T20:15:15.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105661 (GCVE-0-2026-105661)
Vulnerability from cvelistv5 – Published: 2026-10-18 18:56 – Updated: 2026-10-19 20:14
VLAI
EPSS
VEX
Title
Gitea panic on the repositories route of individual users
Summary
Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:14 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39839 | patch |
| https://github.com/go-gitea/gitea/pull/39847 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-105661",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:14:17.983178Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:14:33.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/kewmine"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/tienpa99"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/gemstone-source"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:56:41.198Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-c3cr-qq9g-666c",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-c3cr-qq9g-666c"
},
{
"name": "Fix: go-gitea/gitea pull request #39839",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39839"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39847",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39847"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea panic on the repositories route of individual users"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-105661",
"datePublished": "2026-10-18T18:56:41.198Z",
"dateReserved": "2026-10-14T20:08:45.842Z",
"dateUpdated": "2026-10-19T20:14:33.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109553 (GCVE-0-2026-109553)
Vulnerability from cvelistv5 – Published: 2026-10-18 18:51 – Updated: 2026-10-19 20:19
VLAI
EPSS
VEX
Title
Gitea SSH certificate principal impersonation of other users
Summary
Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:19 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39839 | patch |
| https://github.com/go-gitea/gitea/pull/39847 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-109553",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:19:01.147709Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:19:06.039Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/DshtAnger"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user\u0027s public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:51:31.037Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-vcp6-2qc6-gvq3",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-vcp6-2qc6-gvq3"
},
{
"name": "Fix: go-gitea/gitea pull request #39839",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39839"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39847",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39847"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea SSH certificate principal impersonation of other users"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-109553",
"datePublished": "2026-10-18T18:51:31.037Z",
"dateReserved": "2026-10-14T20:08:45.856Z",
"dateUpdated": "2026-10-19T20:19:06.039Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104627 (GCVE-0-2026-104627)
Vulnerability from cvelistv5 – Published: 2026-10-18 18:51 – Updated: 2026-10-19 20:20
VLAI
EPSS
VEX
Title
Gitea OpenID account linking without session binding
Summary
The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:20 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39642 | patch |
| https://github.com/go-gitea/gitea/pull/39744 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104627",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:20:04.646263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:20:15.460Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/cyberlanc3r"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/u2usvc"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker\u0027s identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:51:06.543Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-mf69-7pqq-86vx",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-mf69-7pqq-86vx"
},
{
"name": "Fix: go-gitea/gitea pull request #39642",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39642"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39744",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39744"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea OpenID account linking without session binding"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-104627",
"datePublished": "2026-10-18T18:51:06.543Z",
"dateReserved": "2026-10-14T20:08:45.852Z",
"dateUpdated": "2026-10-19T20:20:15.460Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}