Product by Gitea
Gitea Open Source Git Server
97 known vulnerabilities in Gitea Open Source Git Server (Gitea), 0 of them actively exploited (CISA KEV).
Key figures
97
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
22
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2024-6886 | Inproper Sanitation of field leading to stored XSS | — | |
| Critical | CVE-2026-20896 | Gitea Docker image trusts spoofable reverse-proxy headers by default | 9.8 | |
| High | CVE-2026-27771 | Gitea Composer package source links use insufficient permission checks | 8.2 | |
| Critical | CVE-2026-56654 | Privilege Escalation via Access Token Scope Escalation in API | 9.8 | |
| High | CVE-2026-27775 | Gitea pre-receive hook permission cache allows full repository write access | 8.8 | |
| Critical | CVE-2026-26292 | Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions | 9.8 | |
| Critical | CVE-2026-27780 | Gitea pre-receive hook can miss branch-protection checks after scanner errors | 9.8 | |
| Critical | CVE-2026-56443 | Gitea Open Source Git Server: Incorrect Authorization | 9.6 | |
| Critical | CVE-2026-58443 | Public-only repository tokens can update private PR head branches | 9.1 | |
| Critical | CVE-2026-20706 | Gitea repository archive downloads bypass token scope checks | 9.1 | |
| Critical | CVE-2026-58433 | Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting | 9.1 | |
| Critical | CVE-2026-55982 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | 9.1 | |
| Critical | CVE-2026-25718 | Gitea template repository generation mishandles symlinked paths | 9.1 | |
| Critical | CVE-2026-58508 | Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) | 9.1 | |
| Critical | CVE-2026-56750 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session | 9.1 | |
| Critical | CVE-2026-22547 | Gitea repository creation accepts invalid field values | 9.1 | |
| Critical | CVE-2026-22874 | Gitea webhook and migration allow-list filtering permits SSRF | 9.6 | |
| Critical | CVE-2026-58422 | Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts | 9.8 | |
| High | CVE-2026-58436 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | 7.5 | |
| Critical | CVE-2026-26247 | Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange | 9.1 | |
| Critical | CVE-2026-26232 | Gitea OAuth2 authorization codes lack expiry and reuse enforcement | 9.1 | |
| High | CVE-2026-58439 | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag | 8.1 | |
| High | CVE-2026-26307 | Gitea git grep search lacks a timeout | 7.5 | |
| High | CVE-2026-28699 | Gitea Basic Auth bypasses OAuth2 access token scopes | 8.1 | |
| High | CVE-2026-25038 | Gitea private organization labels are visible to unauthorized users | 7.5 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32sans-atrisk-mail,
- Cyber Incidents Reported to Regulators: Craneware and Fairlifesans-newsbites-mail,
- Critical Gitea Flaw Under Active Exploitation, Researchers Warnsecurityweek,
- Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosurethehackernews,
- Gitea Vulnerability Exposes Private Container Images without Authenticationthehackernews,