Start for Free
go

code.gitea.io/gitea

View on go registry
100 Total advisories
100 Vulnerabilities
0 Malware

Dependency scanning

Check whether code.gitea.io/gitea is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

HIGH 8.2
Go

CVE-2025-68939

Gitea allows attackers to add attachments with forbidden file extensions
HIGH 7.5
Go

CVE-2026-34966

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
MEDIUM 4.3
Go

CVE-2026-56443

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
HIGH 7.7
Go

CVE-2026-58314

Gitea: Two SSRF findings
MEDIUM 6.2
Go

CVE-2026-56657

Gitea SSH Key Parser Denial of Service
HIGH 7.5
Go

CVE-2026-27660

Gitea draft releases and attachments are exposed without write permission
HIGH 7.5
Go

CVE-2026-27779

Gitea forwarded-proto validation allows canonical URL spoofing
CRITICAL 9.8
Go

CVE-2026-27780

Gitea pre-receive hook scanner errors allow branch-protection bypass
UNKNOWN
Go KEV

CVE-2026-60004

Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev
MEDIUM 5.3
Go

CVE-2026-25782

Gitea tracked-time deletion is not scoped to the requested issue
CRITICAL 9.8
Go

CVE-2026-26292

Gitea LFS mirror operations bypass migration HTTP transport protections
UNKNOWN
Go

CVE-2026-27779

Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-26292

Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-27660

Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-25782

Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-27780

Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea
CRITICAL 9.8
Go

CVE-2024-6886

Gitea Cross-site Scripting Vulnerability
LOW 3.0
Go

CVE-2023-3515

code.gitea.io/gitea Open Redirect vulnerability
HIGH 7.5
Go

CVE-2026-27657

Gitea primary email ownership bypass allows cross-user email changes
HIGH 7.5
Go

CVE-2026-24690

Gitea pull request branch permission checks allow unauthorized updates and rebases
MEDIUM 5.3
Go

CVE-2026-20909

Gitea exposes tracked time entries without repository authorization
HIGH 7.5
Go

CVE-2026-25712

Gitea organization permission APIs expose hidden membership and private organization data
CRITICAL 9.1
Go

CVE-2026-26232

Gitea OAuth2 authorization codes can be reused after expiry
MEDIUM 5.3
Go

CVE-2026-28705

Gitea release asset dumps permit path traversal through crafted names
CRITICAL 9.1
Go

CVE-2026-22547

Gitea repository creation accepts insufficiently validated fields
UNKNOWN
Go

CVE-2026-25712

Gitea organization permission APIs expose hidden membership and private organization data in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-24690

Gitea pull request branch permission checks allow unauthorized updates and rebases in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-26232

Gitea OAuth2 authorization codes can be reused after expiry in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-27657

Gitea primary email ownership bypass allows cross-user email changes in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-20909

Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-22547

Gitea repository creation accepts insufficiently validated fields in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-28705

Gitea release asset dumps permit path traversal through crafted names in code.gitea.io/gitea
CRITICAL 9.1
Go

CVE-2026-26247

Gitea OAuth2 PKCE S256 verifier bypass
CRITICAL 9.1
Go

CVE-2026-25718

Gitea template repository generation follows unsafe filesystem paths
HIGH 7.5
Go

CVE-2026-26307

Gitea git grep searches allow server resource exhaustion
UNKNOWN
Go

CVE-2026-25718

Gitea template repository generation follows unsafe filesystem paths in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-26247

Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-26307

Gitea git grep searches allow server resource exhaustion in code.gitea.io/gitea
HIGH 8.1
Go

CVE-2026-58439

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
UNKNOWN
Go

GO-2026-6074

Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions
CRITICAL 9.6
Go

CVE-2026-58443

Gitea: Public-only repository tokens can update private PR head branches
UNKNOWN
Go

CVE-2026-55982

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
HIGH 7.5
Go

CVE-2026-24451

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private
HIGH 7.5
Go

CVE-2026-25038

Gitea: Unauthorized Access to Labels of Private Organizations
CRITICAL 9.6
Go

CVE-2026-58426

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
MEDIUM 6.5
Go

CVE-2026-58418

Gitea: SSRF via HTTP Redirect in Repository Migration
MEDIUM 6.5
Go

CVE-2026-42931

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
LOW 3.1
Go

CVE-2026-23603

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
MEDIUM 5.4
Go

CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation
UNKNOWN
Go

CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session
MEDIUM 5.9
Go

CVE-2026-58432

Gitea: draft release attachment disclosure via missing web authorization
MEDIUM 6.3
Go

CVE-2026-58441

Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
MEDIUM 4.3
Go

CVE-2026-59766

Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`
MEDIUM 4.3
Go

CVE-2026-58510

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
MEDIUM 6.5
Go

CVE-2026-58442

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass
LOW 2.7
Go

CVE-2026-55984

Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
HIGH 8.1
Go

CVE-2026-55987

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
HIGH 7.5
Go

CVE-2026-58421

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
MEDIUM 5.3
Go

CVE-2026-58507

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint
UNKNOWN
Go

CVE-2026-58434

Gitea: Private Repository Metadata Remains Accessible After Access Revocation
MEDIUM 4.3
Go

CVE-2026-58425

Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
LOW 2.7
Go

CVE-2026-58445

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
UNKNOWN
Go

CVE-2026-25038

Gitea: Unauthorized Access to Labels of Private Organizations in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-24451

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-58439

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag in go-gitea/gitea
UNKNOWN
Go

CVE-2026-58421

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-58418

Gitea: SSRF via HTTP Redirect in Repository Migration in code.gitea.io/gitea
UNKNOWN
Go

GHSA-rjvx-x5h2-6px5

Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-58426

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea
HIGH 7.1
Go

CVE-2026-58437

Gitea: Repository Visibility Manipulation via Git Push Options
MEDIUM 6.5
Go

CVE-2026-57897

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
MEDIUM 5.9
Go

CVE-2026-57886

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content
MEDIUM 6.5
Go

CVE-2026-58428

Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
CRITICAL 9.8
Go

CVE-2026-20896

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
HIGH 7.5
Go

CVE-2026-58419

Gitea: Notification API leaks private issue metadata after access revocation
HIGH 8.8
Go

CVE-2026-27775

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
MEDIUM 4.3
Go

CVE-2026-58444

Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
UNKNOWN
Go

CVE-2026-59763

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
MEDIUM 4.9
Go

CVE-2026-58429

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
UNKNOWN
Go

CVE-2026-56654

Gitea: Privilege Escalation via Access Token Scope Escalation in API
UNKNOWN
Go

CVE-2026-58422

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
MEDIUM 4.3
Go

CVE-2026-50105

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
HIGH 7.5
Go

CVE-2026-54481

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override
HIGH 8.2
Go

CVE-2026-27771

Gitea has insufficient permission checks for Composer package source links
MEDIUM 4.3
Go

CVE-2026-27761

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
HIGH 8.5
Go

CVE-2026-57894

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
CRITICAL 9.6
Go

CVE-2026-22874

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
HIGH 8.9
Go

CVE-2026-58424

Gitea: Permanent Fork PR Workflow Approval Gate Bypass
HIGH 7.7
Go

CVE-2026-58423

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
LOW 2.7
Go

CVE-2026-58511

Gitea: Webhook Authorization Header Returned in Plaintext via API
UNKNOWN
Go

CVE-2026-58436

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
UNKNOWN
Go

CVE-2026-56755

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
HIGH 7.1
Go

CVE-2026-20779

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
UNKNOWN
Go

CVE-2026-27761

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-58423

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-58424

Gitea: Permanent Fork PR Workflow Approval Gate Bypass in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-20896

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-58422

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-58419

Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea
UNKNOWN
Go

CVE-2026-20779

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface in code.gitea.io/gitea

Browse more Go advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes