Gitea.

Gitea limited-visibility profile disclosure with public-only tokens

• Gitea
• CWE-1220

Gitea user and organization feed token scope bypass

• Gitea
• Broken access control

Gitea private pull request disclosure on project boards

• Gitea
• Broken access control

Gitea public-only token bypass on bulk organization repository deletion

• Gitea
• Broken access control

Gitea issue changes on archived repositories through the API

• Gitea

Gitea public-only token bypass in repository and organization creation

• Gitea

Gitea OAuth2 userinfo private group disclosure to public-only tokens

• Gitea
• Information disclosure
• Broken access control

Gitea public-only package token access to private OCI blobs

• Gitea
• Broken access control

Gitea Helm chart upload decompression denial of service

• Gitea
• Denial of service
• CWE-409

Gitea private issue disclosure through issue dependency timeline events

• Gitea
• Information disclosure
• Broken access control

Gitea private repository listing to public-only tokens on profiles

• Gitea

Gitea admin API public-only token scope bypass

• Gitea
• Broken access control
• CWE-1259

Gitea Actions job token spoofing of instance-signed commits

• Gitea
• Weak cryptography or TLS

Gitea archived repository release, milestone and label modification

• Gitea
• Broken access control

Gitea public-only token bypass through Actions runner registration

• Gitea
• Broken access control

Gitea contribution heatmap private activity disclosure to public-only tokens

• Gitea
• Information disclosure

Gitea stored XSS through legacy Actions artifact Content-Encoding

• Gitea
• Cross-site scripting (XSS)

Gitea Actions task token private repository enumeration

• Gitea
• Information disclosure
• Broken access control

Gitea OAuth2 account auto-linking takeover through the sign-up form

• Gitea
• Authentication bypass
• Broken access control

Gitea Actions fork workflow trust through pull request review commit

• Gitea
• Broken access control

Gitea API disclosure of private user social graph, keys and stars

• Gitea
• Broken access control

Gitea label deletion across repository and organization IDs

• Gitea
• Broken access control

Gitea release attachment re-linking of issue attachments

• Gitea
• Broken access control

Gitea private profile information disclosure through POST request

• Gitea
• Information disclosure

Gitea draft release creation disclosing attachment metadata

• Gitea
• Information disclosure

Gitea watched repositories API disclosure after access revocation

• Gitea
• Broken access control

Gitea reactions accepted on locked issues and comments

• Gitea
• Broken access control

Gitea cross-site request forgery on repository topics

• Gitea
• Cross-site request forgery (CSRF)

Gitea Actions artifact v4 API unbounded request body

• Gitea
• Denial of service

Gitea panic on the repositories route of individual users

• Gitea
• Memory corruption
• CWE-248

Gitea SSH certificate principal impersonation of other users

• Gitea
• Authentication bypass

Gitea OpenID account linking without session binding

• Gitea
• Authentication bypass
• Cross-site request forgery (CSRF)

Gitea private attachment disclosure through repository mismatch

• Gitea
• Broken access control
• CWE-1220

Gitea blind SSRF through OpenID assertion verification

• Gitea
• Server-side request forgery (SSRF)

Gitea repository ownership escalation by administrators

• Gitea
• Privilege escalation

Gitea API token scope escalation through HTTP signatures

• Gitea
• Privilege escalation
• Broken access control

Gitea reusable workflow secret exposure in pull_request_target

• Gitea
• Code injection
• CWE-829

Gitea external renderer argument injection and code execution

• Gitea
• Command injection

Gitea second-factor bypass through OpenID identity linking

• Gitea
• Authentication bypass
• CWE-696

Gitea Maven checksum upload quota bypass and memory exhaustion

• Gitea
• Denial of service

Gitea hidden-owner repository listing disclosure

• Gitea
• Information disclosure

Gitea repository initialization resource exhaustion

• Gitea
• Denial of service

Gitea private workflow badge token scope bypass

• Gitea
• Broken access control

Gitea private pull request title disclosure through markup

• Gitea
• Broken access control

Gitea fork workflow approval bypass through review events

• Gitea
• Broken access control

Gitea organization listing token scope bypass

• Gitea
• Broken access control

Gitea private comparison disclosure with public-only tokens

• Gitea
• Broken access control

Gitea local code execution through writable Git hooks

• Gitea
• Broken access control

Gitea private migration creation with public-only tokens

• Gitea
• Broken access control

Gitea organization repository creation token scope bypass

• Gitea
• Broken access control

Gitea restricted-user SSH and GPG key metadata disclosure

• Gitea
• Broken access control

Gitea restricted-user issue search disclosure

• Gitea
• Broken access control

Gitea restricted-user activity and heatmap disclosure

• Gitea
• Broken access control

Gitea fork workflow approval bypass through concurrency cancellation

• Gitea
• Broken access control

Gitea required Actions check bypass through skipped workflows

• Gitea
• Broken access control
• CWE-345

Gitea restricted-user organization metadata disclosure

• Gitea
• Information disclosure
• Broken access control

Gitea restricted-user package visibility bypass

• Gitea
• Broken access control

Gitea private reusable workflow disclosure to fork runs

• Gitea
• CWE-280

Gitea Swift package manifest memory exhaustion

• Gitea
• Denial of service

Gitea Alpine package parsing memory exhaustion

• Gitea
• Denial of service