Gitea vulnerabilities and CVEs

Known vulnerabilities affecting Gitea, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

22 vulnerabilities tracked. 1 confirmed exploited in the wild. 1 with public exploit code.

• — Gitea Code Injection Vulnerability CVE-2026-60004 Exploited 25 Aug 2026
• 7.5 Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. CVE-2026-109553 18 Oct 2026
• — The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility… CVE-2026-119627 1 Nov 2026
• — The /{username} web route accepted personal access tokens over HTTP Basic authentication without checking their scope. CVE-2026-119625 1 Nov 2026
• — Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the… CVE-2026-119533 1 Nov 2026
• — DELETE /api/v1/orgs/{org}/repos deletes all repositories of an organization, but it did not enforce the public-only restriction of access… CVE-2026-119441 1 Nov 2026
• — The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check… CVE-2026-118504 1 Nov 2026
• — Gitea 1.27.3 stopped personal access tokens restricted to public resources (public-only) from creating repositories through POST… CVE-2026-118395 1 Nov 2026
• — The OAuth2 userinfo endpoint (/login/oauth/userinfo) decided whether to limit the groups claim to public organizations by re-parsing the… CVE-2026-118394 1 Nov 2026
• — The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the… CVE-2026-117685 1 Nov 2026
• — When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for Chart.yaml without limiting… CVE-2026-117677 1 Nov 2026
• — The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency… CVE-2026-117649 1 Nov 2026
• — The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories… CVE-2026-117646 1 Nov 2026
• — The /api/v1/admin route group did not enforce the public-only restriction of personal access tokens. CVE-2026-117635 1 Nov 2026
• — The GITEATOKEN of a Gitea Actions job authenticates as the gitea-actions system user, and the /api/v1/user email and GPG key endpoints… CVE-2026-116474 1 Nov 2026
• — The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. CVE-2026-116296 1 Nov 2026
• — Gitea did not reject personal access tokens restricted to public resources (public-only) on the organization Actions runner… CVE-2026-116289 1 Nov 2026
• — GET /api/v1/users/{username}/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the… CVE-2026-114199 1 Nov 2026
• — Legacy (v1 to v3) Actions artifact uploads stored the request's Content-Encoding header unchecked in the column that is served as the… CVE-2026-113429 1 Nov 2026
• — Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project… CVE-2026-112887 1 Nov 2026
• — When [oauth2client].ACCOUNTLINKING is set to auto (not the default) and registration is enabled, the link-account sign-up form looked up… CVE-2026-120263 1 Nov 2026
• — Workflows triggered by a pull request review were read from the commit named in the review's commitid, while the fork restrictions were… CVE-2026-118386 1 Nov 2026