# Gitea.

Every CVE that names Gitea among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Gitea limited-visibility profile disclosure with public-only tokens](https://agentprime.io/advisories/CVE-2026-119627.md)
  `CVE-2026-119627` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: CWE-1220
- [Gitea user and organization feed token scope bypass](https://agentprime.io/advisories/CVE-2026-119625.md)
  `CVE-2026-119625` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea private pull request disclosure on project boards](https://agentprime.io/advisories/CVE-2026-119533.md)
  `CVE-2026-119533` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea public-only token bypass on bulk organization repository deletion](https://agentprime.io/advisories/CVE-2026-119441.md)
  `CVE-2026-119441` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea issue changes on archived repositories through the API](https://agentprime.io/advisories/CVE-2026-118504.md)
  `CVE-2026-118504` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026
- [Gitea public-only token bypass in repository and organization creation](https://agentprime.io/advisories/CVE-2026-118395.md)
  `CVE-2026-118395` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026
- [Gitea OAuth2 userinfo private group disclosure to public-only tokens](https://agentprime.io/advisories/CVE-2026-118394.md)
  `CVE-2026-118394` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control
- [Gitea public-only package token access to private OCI blobs](https://agentprime.io/advisories/CVE-2026-117685.md)
  `CVE-2026-117685` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea Helm chart upload decompression denial of service](https://agentprime.io/advisories/CVE-2026-117677.md)
  `CVE-2026-117677` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Denial of service, CWE-409
- [Gitea private issue disclosure through issue dependency timeline events](https://agentprime.io/advisories/CVE-2026-117649.md)
  `CVE-2026-117649` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control
- [Gitea private repository listing to public-only tokens on profiles](https://agentprime.io/advisories/CVE-2026-117646.md)
  `CVE-2026-117646` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026
- [Gitea admin API public-only token scope bypass](https://agentprime.io/advisories/CVE-2026-117635.md)
  `CVE-2026-117635` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control, CWE-1259
- [Gitea Actions job token spoofing of instance-signed commits](https://agentprime.io/advisories/CVE-2026-116474.md)
  `CVE-2026-116474` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Weak cryptography or TLS
- [Gitea archived repository release, milestone and label modification](https://agentprime.io/advisories/CVE-2026-116296.md)
  `CVE-2026-116296` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea public-only token bypass through Actions runner registration](https://agentprime.io/advisories/CVE-2026-116289.md)
  `CVE-2026-116289` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea contribution heatmap private activity disclosure to public-only tokens](https://agentprime.io/advisories/CVE-2026-114199.md)
  `CVE-2026-114199` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure
- [Gitea stored XSS through legacy Actions artifact Content-Encoding](https://agentprime.io/advisories/CVE-2026-113429.md)
  `CVE-2026-113429` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Gitea Actions task token private repository enumeration](https://agentprime.io/advisories/CVE-2026-112887.md)
  `CVE-2026-112887` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control
- [Gitea OAuth2 account auto-linking takeover through the sign-up form](https://agentprime.io/advisories/CVE-2026-120263.md)
  `CVE-2026-120263` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Authentication bypass, Broken access control
- [Gitea Actions fork workflow trust through pull request review commit](https://agentprime.io/advisories/CVE-2026-118386.md)
  `CVE-2026-118386` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea API disclosure of private user social graph, keys and stars](https://agentprime.io/advisories/CVE-2026-97859.md)
  `CVE-2026-97859` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Gitea label deletion across repository and organization IDs](https://agentprime.io/advisories/CVE-2026-97204.md)
  `CVE-2026-97204` · CVE record: Gitea Gitea · CVSS 3.1 Low · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Gitea release attachment re-linking of issue attachments](https://agentprime.io/advisories/CVE-2026-110494.md)
  `CVE-2026-110494` · CVE record: Gitea Gitea · CVSS 6.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Gitea private profile information disclosure through POST request](https://agentprime.io/advisories/CVE-2026-110324.md)
  `CVE-2026-110324` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Information disclosure
- [Gitea draft release creation disclosing attachment metadata](https://agentprime.io/advisories/CVE-2026-110311.md)
  `CVE-2026-110311` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Information disclosure
- [Gitea watched repositories API disclosure after access revocation](https://agentprime.io/advisories/CVE-2026-109844.md)
  `CVE-2026-109844` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Gitea reactions accepted on locked issues and comments](https://agentprime.io/advisories/CVE-2026-107686.md)
  `CVE-2026-107686` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Gitea cross-site request forgery on repository topics](https://agentprime.io/advisories/CVE-2026-107618.md)
  `CVE-2026-107618` · CVE record: Gitea Gitea · CVSS 8.1 High · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Gitea Actions artifact v4 API unbounded request body](https://agentprime.io/advisories/CVE-2026-105964.md)
  `CVE-2026-105964` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Denial of service
- [Gitea panic on the repositories route of individual users](https://agentprime.io/advisories/CVE-2026-105661.md)
  `CVE-2026-105661` · CVE record: Gitea Gitea · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Memory corruption, CWE-248
- [Gitea SSH certificate principal impersonation of other users](https://agentprime.io/advisories/CVE-2026-109553.md)
  `CVE-2026-109553` · CVE record: Gitea Gitea · CVSS 7.5 High · Not analysed yet · Published 18 Oct 2026 · Tags: Authentication bypass
- [Gitea OpenID account linking without session binding](https://agentprime.io/advisories/CVE-2026-104627.md)
  `CVE-2026-104627` · CVE record: Gitea Gitea · CVSS 5.4 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF)
- [Gitea private attachment disclosure through repository mismatch](https://agentprime.io/advisories/CVE-2026-78433.md)
  `CVE-2026-78433` · CVE record: Gitea Gitea · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control, CWE-1220
- [Gitea blind SSRF through OpenID assertion verification](https://agentprime.io/advisories/CVE-2026-78231.md)
  `CVE-2026-78231` · CVE record: Gitea Gitea · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Gitea repository ownership escalation by administrators](https://agentprime.io/advisories/CVE-2026-73814.md)
  `CVE-2026-73814` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Privilege escalation
- [Gitea API token scope escalation through HTTP signatures](https://agentprime.io/advisories/CVE-2026-73804.md)
  `CVE-2026-73804` · CVE record: Gitea Gitea · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Gitea reusable workflow secret exposure in pull_request_target](https://agentprime.io/advisories/CVE-2026-73800.md)
  `CVE-2026-73800` · CVE record: Gitea Gitea · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Code injection, CWE-829
- [Gitea external renderer argument injection and code execution](https://agentprime.io/advisories/CVE-2026-73539.md)
  `CVE-2026-73539` · CVE record: Gitea Gitea · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection
- [Gitea second-factor bypass through OpenID identity linking](https://agentprime.io/advisories/CVE-2026-73535.md)
  `CVE-2026-73535` · CVE record: Gitea Gitea · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, CWE-696
- [Gitea Maven checksum upload quota bypass and memory exhaustion](https://agentprime.io/advisories/CVE-2026-73273.md)
  `CVE-2026-73273` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Denial of service
- [Gitea hidden-owner repository listing disclosure](https://agentprime.io/advisories/CVE-2026-73135.md)
  `CVE-2026-73135` · CVE record: Gitea Gitea · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [Gitea repository initialization resource exhaustion](https://agentprime.io/advisories/CVE-2026-73130.md)
  `CVE-2026-73130` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Denial of service
- [Gitea private workflow badge token scope bypass](https://agentprime.io/advisories/CVE-2026-73126.md)
  `CVE-2026-73126` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea private pull request title disclosure through markup](https://agentprime.io/advisories/CVE-2026-71301.md)
  `CVE-2026-71301` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea fork workflow approval bypass through review events](https://agentprime.io/advisories/CVE-2026-71184.md)
  `CVE-2026-71184` · CVE record: Gitea Gitea · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea organization listing token scope bypass](https://agentprime.io/advisories/CVE-2026-70407.md)
  `CVE-2026-70407` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea private comparison disclosure with public-only tokens](https://agentprime.io/advisories/CVE-2026-70406.md)
  `CVE-2026-70406` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea local code execution through writable Git hooks](https://agentprime.io/advisories/CVE-2026-70402.md)
  `CVE-2026-70402` · CVE record: Gitea Gitea · CVSS 5.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea private migration creation with public-only tokens](https://agentprime.io/advisories/CVE-2026-70400.md)
  `CVE-2026-70400` · CVE record: Gitea Gitea · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea organization repository creation token scope bypass](https://agentprime.io/advisories/CVE-2026-70396.md)
  `CVE-2026-70396` · CVE record: Gitea Gitea · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea restricted-user SSH and GPG key metadata disclosure](https://agentprime.io/advisories/CVE-2026-68964.md)
  `CVE-2026-68964` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea restricted-user issue search disclosure](https://agentprime.io/advisories/CVE-2026-68957.md)
  `CVE-2026-68957` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea restricted-user activity and heatmap disclosure](https://agentprime.io/advisories/CVE-2026-67577.md)
  `CVE-2026-67577` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea fork workflow approval bypass through concurrency cancellation](https://agentprime.io/advisories/CVE-2026-66877.md)
  `CVE-2026-66877` · CVE record: Gitea Gitea · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea required Actions check bypass through skipped workflows](https://agentprime.io/advisories/CVE-2026-66874.md)
  `CVE-2026-66874` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control, CWE-345, CWE-693, CWE-807
- [Gitea restricted-user organization metadata disclosure](https://agentprime.io/advisories/CVE-2026-66853.md)
  `CVE-2026-66853` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Broken access control
- [Gitea restricted-user package visibility bypass](https://agentprime.io/advisories/CVE-2026-66849.md)
  `CVE-2026-66849` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea private reusable workflow disclosure to fork runs](https://agentprime.io/advisories/CVE-2026-63792.md)
  `CVE-2026-63792` · CVE record: Gitea Gitea · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-280
- [Gitea Swift package manifest memory exhaustion](https://agentprime.io/advisories/CVE-2026-63021.md)
  `CVE-2026-63021` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Denial of service
- [Gitea Alpine package parsing memory exhaustion](https://agentprime.io/advisories/CVE-2026-62925.md)
  `CVE-2026-62925` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Denial of service

Older: <https://agentprime.io/advisories/technology/gitea.md?cursor=WyIyMDI2LTEwLTE0VDE0OjI4OjUxLjQ3MjAwMFoiLCJDVkUtMjAyNi02MjkyNSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=gitea>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/gitea/>. Everything for agents: <https://agentprime.io/llms.txt>.