Veille CVE

Recherche « Gitea Open Source Git Server »

88 CVE

Critique 18 Élevée 35 Moyenne 31 Faible 4 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Gitea Open Source Git Server » ✕
  1. CVE-2026-25946 5.3 Moyenne

    Gitea

    When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker.

  2. CVE-2026-59765 7.5 Élevée

    Gitea Open Source Git Server

    SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

  3. CVE-2026-59763 4.3 Moyenne

    Gitea Open Source Git Server

    Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

  4. CVE-2026-58511 2.7 Faible

    Gitea Open Source Git Server

    Webhook Authorization Header Returned in Plaintext via API

  5. CVE-2026-58510 4.3 Moyenne

    Gitea Open Source Git Server

    GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

  6. CVE-2026-58508 9.1 Critique

    Gitea Open Source Git Server

    Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

  7. CVE-2026-58507 5.3 Moyenne

    Gitea Open Source Git Server

    Private Repository Existence Disclosure via go-get Meta Endpoint

  8. CVE-2026-58445 2.7 Faible

    Gitea Open Source Git Server

    Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

  9. CVE-2026-58444 4.3 Moyenne

    Gitea Open Source Git Server

    Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

  10. CVE-2026-58443 9.1 Critique

    Gitea Open Source Git Server

    Public-only repository tokens can update private PR head branches

  11. CVE-2026-58442 6.5 Moyenne

    Gitea Open Source Git Server

    Repository migration SSRF via multi-answer DNS allow-list bypass

  12. CVE-2026-58441 6.3 Moyenne

    Gitea Open Source Git Server

    SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

  13. CVE-2026-58440 6.8 Moyenne

    Gitea Open Source Git Server

    Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

  14. CVE-2026-58439 8.1 Élevée

    Gitea Open Source Git Server

    Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

  15. CVE-2026-58438 7.5 Élevée

    Gitea Open Source Git Server

    Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

  16. CVE-2026-58437 7.1 Élevée

    Gitea Open Source Git Server

    Repository Visibility Manipulation via Git Push Options

  17. CVE-2026-58436 7.5 Élevée

    Gitea Open Source Git Server

    ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

  18. CVE-2026-58435 5.4 Moyenne

    Gitea Open Source Git Server

    Gitea LFS Deploy-Key Privilege Escalation

  19. CVE-2026-58434 7.5 Élevée

    Gitea Open Source Git Server

    Private Repository Metadata Remains Accessible After Access Revocation

  20. CVE-2026-58433 9.1 Critique

    Gitea Open Source Git Server

    Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

  21. CVE-2026-58432 5.9 Moyenne

    Gitea Open Source Git Server

    Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

  22. CVE-2026-58431 4.3 Moyenne

    Gitea Open Source Git Server

    Public-only API token restriction is not enforced on team API routes

  23. CVE-2026-58429 4.9 Moyenne

    Gitea Open Source Git Server

    Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

  24. CVE-2026-58428 6.5 Moyenne

    Gitea Open Source Git Server

    Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

  25. CVE-2026-58427 7.5 Élevée

    Gitea Open Source Git Server

    Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

  26. CVE-2026-58425 4.3 Moyenne

    Gitea Open Source Git Server

    OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

  27. CVE-2026-58420 4.4 Moyenne

    Gitea Open Source Git Server

    Local File Inclusion via file:// URI in Migration Restore

  28. CVE-2026-58417 7.5 Élevée

    Gitea Open Source Git Server

    REST API exposes organization membership of private organizations to public

  29. CVE-2026-58416 7.1 Élevée

    Gitea Open Source Git Server

    Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

  30. CVE-2026-58314 7.7 Élevée

    Gitea Open Source Git Server

    Two SSRF findings in Gitea 1.26.2

  31. CVE-2026-57897 6.5 Moyenne

    Gitea Open Source Git Server

    Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

  32. CVE-2026-57894 8.5 Élevée

    Gitea Open Source Git Server

    Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

  33. CVE-2026-57886 5.9 Moyenne

    Gitea Open Source Git Server

    Cross-repository issue/comment attachment re-linking can expose private attachment content

  34. CVE-2026-56755 6.2 Moyenne

    Gitea Open Source Git Server

    Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

  35. CVE-2026-56750 9.1 Critique

    Gitea Open Source Git Server

    Gitea Remember-Me Token Theft Not Invalidating Attacker Session

  36. CVE-2026-56657 6.2 Moyenne

    Gitea Open Source Git Server

    Gitea SSH Key Parser Denial of Service

  37. CVE-2026-56654 9.8 Critique

    Gitea Open Source Git Server

    Privilege Escalation via Access Token Scope Escalation in API

  38. CVE-2026-56443 9.6 Critique

    Gitea Open Source Git Server

    Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

  39. CVE-2026-55987 8.1 Élevée

    Gitea Open Source Git Server

    OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

  40. CVE-2026-55986 5.4 Moyenne

    Gitea Open Source Git Server

    Email Management API Bypasses ManageCredentials Feature Restrictions

  41. CVE-2026-55984 2.7 Faible

    Gitea Open Source Git Server

    Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

  42. CVE-2026-55982 9.1 Critique

    Gitea Open Source Git Server

    OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

  43. CVE-2026-54481 7.5 Élevée

    Gitea Open Source Git Server

    Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

  44. CVE-2026-50105 4.3 Moyenne

    Gitea Open Source Git Server

    RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

  45. CVE-2026-42931 6.5 Moyenne

    Gitea Open Source Git Server

    Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

  46. CVE-2026-24791 8.1 Élevée

    Gitea Open Source Git Server

    Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

  47. CVE-2026-24059 6.5 Moyenne

    Gitea Open Source Git Server

    The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.

  48. CVE-2026-23603 3.1 Faible

    Gitea Open Source Git Server

    Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

  49. CVE-2026-58426 9.6 Critique

    Gitea Open Source Git Server

    Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

  50. CVE-2026-58424 8.9 Élevée

    Gitea Open Source Git Server

    Permanent Fork PR Workflow Approval Gate Bypass

  51. CVE-2026-58423 7.7 Élevée

    Gitea Open Source Git Server

    LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

  52. CVE-2026-58422 9.8 Critique

    Gitea Open Source Git Server

    Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

  53. CVE-2026-58421 7.5 Élevée

    Gitea Open Source Git Server

    Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

  54. CVE-2026-58419 7.5 Élevée

    Gitea Open Source Git Server

    Notification API leaks private issue metadata after access revocation

  55. CVE-2026-58418 6.5 Moyenne

    Gitea Open Source Git Server

    SSRF via HTTP Redirect in Repository Migration

  56. CVE-2026-28744 8.1 Élevée

    Gitea Open Source Git Server

    Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

  57. CVE-2026-28740 7.1 Élevée

    Gitea Open Source Git Server

    Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

  58. CVE-2026-28737 8.7 Élevée

    Gitea Open Source Git Server

    Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.

  59. CVE-2026-28705 5.3 Moyenne

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

  60. CVE-2026-28699 8.1 Élevée

    Gitea Open Source Git Server

    Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

  61. CVE-2026-27783 4.3 Moyenne

    Gitea Open Source Git Server

    Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.

  62. CVE-2026-27780 9.8 Critique

    Gitea Open Source Git Server

    Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

  63. CVE-2026-27779 7.5 Élevée

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.

  64. CVE-2026-27775 8.8 Élevée

    Gitea Open Source Git Server

    Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

  65. CVE-2026-27771 8.2 Élevée

    Gitea Open Source Git Server

    Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

  66. CVE-2026-27761 4.3 Moyenne

    Gitea Open Source Git Server

    Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

  67. CVE-2026-27660 7.5 Élevée

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.

  68. CVE-2026-27657 7.5 Élevée

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 allow a user to change another user's primary email address.

  69. CVE-2026-26307 7.5 Élevée

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.

  70. CVE-2026-26292 9.8 Critique

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

  71. CVE-2026-26247 9.1 Critique

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

  72. CVE-2026-26232 9.1 Critique

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.

  73. CVE-2026-26231 8.5 Élevée

    Gitea Open Source Git Server

    Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

  74. CVE-2026-25782 5.3 Moyenne

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.

  75. CVE-2026-25779 6.1 Moyenne

    Gitea Open Source Git Server

    Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.

  76. CVE-2026-25718 9.1 Critique

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.

  77. CVE-2026-25714 4.3 Moyenne

    Gitea Open Source Git Server

    Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.

  78. CVE-2026-25712 7.5 Élevée

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.

  79. CVE-2026-25038 7.5 Élevée

    Gitea Open Source Git Server

    Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

  80. CVE-2026-24690 7.5 Élevée

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.

  81. CVE-2026-24451 7.5 Élevée

    Gitea Open Source Git Server

    Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

  82. CVE-2026-22874 9.6 Critique

    Gitea Open Source Git Server

    Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

  83. CVE-2026-22555 8.1 Élevée

    Gitea Open Source Git Server

    Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.

  84. CVE-2026-22547 9.1 Critique

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.

  85. CVE-2026-20909 5.3 Moyenne

    Gitea Open Source Git Server

    Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.

  86. CVE-2026-20896 9.8 Critique

    Gitea Open Source Git Server

    Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

  87. CVE-2026-20779 7.1 Élevée

    Gitea Open Source Git Server

    Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.

  88. CVE-2026-20706 9.1 Critique

    Gitea Open Source Git Server

    Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.