| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Repository migration SSRF via multi-answer DNS allow-list bypass |
| SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL |
| Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting |
| Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea |
| Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 |
| Two SSRF findings in Gitea 1.26.2 |
| Private Repository Metadata Remains Accessible After Access Revocation |
| RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) |
| Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) |
| OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes |
| Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service |
| Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 |
| Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints |
| Email Management API Bypasses ManageCredentials Feature Restrictions |
| The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code. |
| Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim |
| Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval. |
| Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) |
| Gitea SSH Key Parser Denial of Service |
| GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private |
