| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Gitea SSH Key Parser Denial of Service |
| GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private |
| Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint |
| Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads |
| Webhook Authorization Header Returned in Plaintext via API |
| Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs |
| Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload |
| Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes |
| Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources. |
| Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path. |
| Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled. |
| Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries. |
| Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values. |
| Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering. |
| Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized. |
| Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches. |
| Gitea 1.26.2 allows unauthorized users to access labels of private organizations. |
| Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations. |
| Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941. |
| Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths. |
