Gitea vulnerabilities
We track 58 vulnerabilities in Gitea products across 4 products. 58 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 1, 2026.
Latest Gitea vulnerabilities
- 7.5 High severity
Gitea Open Source Git Server: Improper Access Control
Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.
- 8.8 High severity
Gitea Open Source Git Server: Incorrect Authorization
Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.
- 8.2 High severity
Gitea Open Source Git Server: Missing Authorization
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.
- 9.8 Critical severity
Gitea Open Source Git Server: Improper Access Control
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
- 9.1 Critical severity
Gitea Open Source Git Server: Improper Access Control
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
- 8.5 High severity
Gitea Open Source Git Server: Incorrect Authorization
Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.
- 9.1 Critical severity
Gitea Open Source Git Server: Improper Link Resolution Before File Access
Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.
- 7.5 High severity
Gitea Open Source Git Server: Exposure of Sensitive Information to an Unauthorized Actor
Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.
- 8.1 High severity
Gitea Open Source Git Server: Improper Access Control
Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.
- 9.1 Critical severity
Gitea versions before 1.25.5 lack validation constraints for repository creation fields…
Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.
- 9.8 Critical severity
Gitea Open Source Git Server: Improper Access Control
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
- 7.1 High severity
Gitea Open Source Git Server: Authentication Bypass by Capture-replay
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.
- 9.9 Critical severity
act_runner: Improper Privilege Management
Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as
- 9.1 Critical severity
Gitea Open Source Git Server: Improper Access Control
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
- 9.1 Critical severity
Gitea Open Source Git Server: Improper Access Control
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
- 9.1 Critical severity
Gitea Open Source Git Server: Improper Access Control
Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.
- 7.5 High severity
Gitea Open Source Git Server: Improper Access Control
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they
- 10.0 Critical severity
Gitea Open Source Git Server: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.