Vendor
45 published CVES affecting gitea.dev, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first · page 1 of 2
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/...
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Webhook Authorization Header Returned in Plaintext via API
Private Repository Existence Disclosure via go-get Meta Endpoint
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
Personal access token scope enforcement bypass on the repository home page (GET /{owner}/{repo}) discloses private repository contents
Public-only repository tokens can update private PR head branches
Repository migration SSRF via multi-answer DNS allow-list bypass
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in DeleteCollaboration)
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Repository Visibility Manipulation via Git Push Options
Gitea LFS Deploy-Key Privilege Escalation
Private Repository Metadata Remains Accessible After Access Revocation
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Public-only API token restriction is not enforced on team API routes
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
REST API exposes organization membership of private organizations to public
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.