Advisories · Technology
Gitea.
Every CVE that names Gitea among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Gitea GitLab migration denial of service
- Gitea
- Denial of service
- CVSS 6.5 Medium
Gitea OneDev migration denial of service
- Gitea
- Denial of service
- CVSS 6.5 Medium
Gitea organization team policy bypass through repository API
- Gitea
- Privilege escalation
- Broken access control
- CVSS 3.5 Low
Gitea Jupyter notebook UI redress through CSS class injection
- Gitea
- Cross-site scripting (XSS)
- CWE-1021
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Gitea Org-mode file disclosure and code execution
- Gitea
- Path traversal
- CVSS 5.3 Medium
Gitea OpenID discovery server-side request forgery
- Gitea
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Gitea profile feed disclosure bypassing user visibility
- Gitea
- Information disclosure
- Broken access control
- CVSS 6.1 Medium
Gitea repository media API stored XSS
- Gitea
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Gitea push-to-create bypass of FORCE_PRIVATE policy
- Gitea
- Broken access control
- CVSS 4.3 Medium
Gitea issue attachment API allows changing comment attachments
- Gitea
- Broken access control
- CVSS 8.1 High
Gitea tag delete route deletes releases without release permission
- Gitea
- Broken access control
- CVSS 6.5 Medium
Gitea migration memory exhaustion from zero page size
- Gitea
- Denial of service
- CVSS 9.1 CriticalCritical · CVSS 9+
Gitea OAuth2 refresh token grant accepts access tokens
- Gitea
- Authentication bypass
- CVSS 4.9 Medium
Gitea push mirror API bypass of DISABLE_NEW_PUSH policy
- Gitea
- Broken access control
- CVSS 7.1 High
Gitea push mirror local path check uses the repository owner
- Gitea
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Gitea WebAuthn bypass during OAuth and OIDC sign-in
- Gitea
- Authentication bypass
- CVSS 4.3 Medium
Gitea private repository access retained after rejected transfer
- Gitea
- Broken access control
- CWE-672
- CVSS 7.5 High
Gitea Actions memory exhaustion through large static matrices
- Gitea
- Denial of service
- CVSS 8.1 High
Gitea installer authentication bypass for existing accounts
- Gitea
- Authentication bypass
- CVSS 4.3 Medium
Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS
- Gitea
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Gitea denial of service through external issue tracker patterns
- Gitea
- Memory corruption
- CWE-248
- CVSS 6.5 Medium
Gitea issue reference parsing CPU exhaustion
- Gitea
- Denial of service
- CVSS 9.8 CriticalCritical · CVSS 9+
Gitea fork workflow approval bypass through maintainer-triggered events
- Gitea
- Broken access control
- CWE-441
- CVSS 7.1 High
Gitea deploy key pushes acting as the repository owner
- Gitea
- Broken access control
- CVSS 7.5 High
Gitea repository migration SSRF through DNS rebinding
- Gitea
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Gitea SSRF through Git HTTP redirects in mirrors and fetches
- Gitea
- Server-side request forgery (SSRF)
- CVSS 8.1 High
Gitea API team demotion not applied to unit permissions
- Gitea
- CWE-272
- CVSS 9.1 CriticalCritical · CVSS 9+
Gitea review and execution mismatch through duplicate tree entries
- Gitea
- CWE-706
- CVSS 8.1 High
Gitea push mirror SSRF and forced writes to internal Git hosts
- Gitea
- Race condition
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Gitea trusted workflow cancellation by unapproved fork runs
- Gitea
- CWE-667
- CVSS 5.4 Medium
Gitea container registry stored XSS through blob media type
- Gitea
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Gitea migration and pull mirror SSRF through multi-answer DNS
- Gitea
- Information disclosure
- Race condition
- CVSS 7.7 High
Gitea migration SSRF through ALLOWED_DOMAINS address check bypass
- Gitea
- CWE-346
- CVSS 8.8 High
Gitea fork workflow job revival through later approval
- Gitea
- CWE-841
- CVSS 9.1 CriticalCritical · CVSS 9+
Gitea built-in SSH server authentication bypass through key case folding
- Gitea
- CWE-305
- CVSS 8.8 High
Gitea fork workflow approval bypass through cancel and rerun
- Gitea
- Broken access control