[NEW] [high] Gitea: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Gitea to execute arbitrary code, gain elevated permissions, bypass security measures, manipulate data, disclose sensitive information, hijack or reuse sessions, or trigger a denial-of-service state.
CSIRTS triage
- What
- Multiple vulnerabilities in Gitea can be exploited by an attacker to execute arbitrary code, gain elevated permissions, bypass security measures, manipulate data, disclose sensitive information, hijack sessions, or trigger a denial-of-service state.
- Who is affected
- Attackers targeting systems running the affected versions of Gitea.
- Urgency
- Remediation is high urgency due to the wide range of potential impacts including remote code execution and privilege escalation.
- Action
- Update to the latest version of Gitea.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Gitea
Get an email when a new Gitea advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2304
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- mediumGHSA-fq2p-5p22-8g6j: Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission End…ghsa
- mediumGHSA-2wm4-vwp6-v7xc: Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and…ghsa
- lowGHSA-3r5c-2xxx-h872: Gitea: Webhook Authorization Header Returned in Plaintext via APIghsa
- mediumGHSA-frpw-3h2q-4jj6: Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIsghsa
- mediumGHSA-q423-49rw-g9mh: Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister…ghsa
- mediumGHSA-h56g-4qw7-2mxg: Gitea: Public-only API token restriction is not enforced on team API routesghsa
- mediumGHSA-prr9-9mp4-5gp2: Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #…ghsa
- highGHSA-2fcr-jfvc-vgg2: Gitea: Two SSRF findingsghsa
- highGHSA-fw57-jgch-pgf3: Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated re…ghsa
- mediumGHSA-4xjf-493q-98p3: Gitea SSH Key Parser Denial of Serviceghsa
- highGHSA-8p9h-49rc-qgxj: Gitea: Repository Visibility Manipulation via Git Push Optionsghsa
- highGHSA-vrhc-jjfc-m3m3: Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources wi…ghsa
Recent advisories for Gitea
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] Gitea: Vulnerability allows code executioncert-bund · 2026-07-29
- highGHSA-gx3v-q759-g323: Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OT…ghsa · 2026-07-21
- mediumGHSA-fq2p-5p22-8g6j: Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission End…ghsa · 2026-07-21
- mediumGHSA-2wm4-vwp6-v7xc: Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and…ghsa · 2026-07-21
- lowGHSA-3r5c-2xxx-h872: Gitea: Webhook Authorization Header Returned in Plaintext via APIghsa · 2026-07-21
- mediumGHSA-frpw-3h2q-4jj6: Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIsghsa · 2026-07-21
More from CERT-Bund (BSI) Security Advisories
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow Denial of Service2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities2026-07-31
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow unspecified attack2026-07-31