{"resultsPerPage":167,"startIndex":0,"totalResults":167,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-29T12:42:53.167","vulnerabilities":[{"cve":{"id":"CVE-2018-15192","sourceIdentifier":"cve@mitre.org","published":"2018-08-08T02:29:00.273","lastModified":"2026-06-17T01:42:12.757","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services."},{"lang":"es","value":"Una vulnerabilidad de Server-Side Request Forgery (SSRF) en webhooks en Gitea hasta la versión 1.5.0-rc2 y Gogs hasta la versión 0.11.53 permite que los atacantes remotos accedan a los servicios de la intranet."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.5.0","matchCriteriaId":"A245EAFE-88C9-470E-9B7A-F8D32F25E2A2"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:1.5.0:rc1:*:*:*:*:*:*","matchCriteriaId":"874A1062-D5F9-4601-9DE0-4D205DF0E29A"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:1.5.0:rc2:*:*:*:*:*:*","matchCriteriaId":"9A2A9763-A3D0-447F-8D7E-3E12AB28E6C0"},{"vulnerable":true,"criteria":"cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*","versionEndIncluding":"0.11.53","matchCriteriaId":"D983AEBA-5615-4545-871A-1C17FC38FA1C"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/issues/4624","source":"cve@mitre.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/gogs/gogs/issues/5366","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/issues/4624","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/gogs/gogs/issues/5366","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-1000803","sourceIdentifier":"cve@mitre.org","published":"2018-10-08T15:29:00.367","lastModified":"2026-06-17T01:33:04.750","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email set as private. This vulnerability appears to have been fixed in 1.5.1."},{"lang":"es","value":"Gitea en versiones anteriores a 1.5.1 contiene una vulnerabilidad CWE-200 que puede resultar en la exposición de las direcciones de email de los usuarios. Este ataque parece ser explotable mediante la visualización de un repositorio para recibir notificaciones de email. Los emails recibidos contienen los otros destinatarios incluso aunque tengan su email configurado como privado. La vulnerabilidad parece haber sido solucionada en la versión 1.5.1."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.5.1","matchCriteriaId":"974565BB-6120-4C7D-90A8-F74254FF2A59"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/pull/4664","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/4664/files#diff-146e0c2b5bb1ea96c9fb73d509456e57","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/4664","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/4664/files#diff-146e0c2b5bb1ea96c9fb73d509456e57","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-18926","sourceIdentifier":"cve@mitre.org","published":"2018-11-04T05:29:00.427","lastModified":"2026-06-17T01:48:08.067","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron."},{"lang":"es","value":"Gitea en versiones anteriores a la 1.5.4 permite la ejecución remota de código debido a que no valida correctamente los ID de sesión. Esto está relacionado con el manejo de ID de sesión en el código go-macaron/session para Macaron."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-384"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.5.4","matchCriteriaId":"E8499823-13BA-4CBE-9963-F4228DE7D18C"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/issues/5140","source":"cve@mitre.org","tags":["Mitigation","Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/issues/5140","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-1000002","sourceIdentifier":"cve@mitre.org","published":"2019-02-04T21:29:00.690","lastModified":"2026-06-17T02:09:23.630","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to \"any\" repository including self-created ones.. This vulnerability appears to have been fixed in 1.6.3, 1.7.0-rc2."},{"lang":"es","value":"Gitea, en versiones 1.6.2 y anteriores, contiene una vulnerabilidad de control de acceso incorrecto en la funcionalidad de eliminación/edición de archivos que puede resultar en que el atacante elimine archivos fuera del repositorio al que tiene acceso. Este ataque parece ser explotable si el atacante consigue acceso de escritura a \"cualquier\" repositorio, incluyendo los creados por él mismo. Esta vulnerabilidad parece haber sido solucionada en las versiones 1.6.3 y 1.7.0-rc2."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndIncluding":"1.6.2","matchCriteriaId":"2F754E28-5B73-4E86-9334-70047D6DE03F"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/pull/5631","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/5631","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-11228","sourceIdentifier":"cve@mitre.org","published":"2019-04-15T12:31:36.603","lastModified":"2026-06-17T02:12:34.690","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress."},{"lang":"es","value":"Versiones anteriores a 1.7.6 y 1.8.x anteriores a 1.8-RC3 de repo/setting.go en Gitea no validan form.MirrorAddress antes de invocar SaveAddress."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.7.6","matchCriteriaId":"864A4420-67DF-445F-8D5C-11D3F64E0165"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:1.8.0:rc1:*:*:*:*:*:*","matchCriteriaId":"0927D13C-5565-456B-B6D9-E2D10C8D8878"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:1.8.0:rc2:*:*:*:*:*:*","matchCriteriaId":"C7661CD1-D457-40B4-8674-BA622EF01EC6"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.7.6","source":"cve@mitre.org","tags":["Patch","Release Notes","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.8.0-rc3","source":"cve@mitre.org","tags":["Patch","Release Notes","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.7.6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Release Notes","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.8.0-rc3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Release Notes","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-11229","sourceIdentifier":"cve@mitre.org","published":"2019-04-15T12:31:36.647","lastModified":"2026-06-17T02:12:34.903","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution."},{"lang":"es","value":"Versiones anteriores a 1.7.6 y 1.8.x anteriores a 1.8-RC3 de models/repo_mirror.go en Gitea maneja mal la configuración de la URL del repositorio espejo, lo que podría producir a una ejecución remota de código."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.7.6","matchCriteriaId":"864A4420-67DF-445F-8D5C-11D3F64E0165"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:1.8.0:rc1:*:*:*:*:*:*","matchCriteriaId":"0927D13C-5565-456B-B6D9-E2D10C8D8878"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:1.8.0:rc2:*:*:*:*:*:*","matchCriteriaId":"C7661CD1-D457-40B4-8674-BA622EF01EC6"}]}]}],"references":[{"url":"http://packetstormsecurity.com/files/160833/Gitea-1.7.5-Remote-Code-Execution.html","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.7.6","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.8.0-rc3","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/160833/Gitea-1.7.5-Remote-Code-Execution.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.7.6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.8.0-rc3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-11576","sourceIdentifier":"cve@mitre.org","published":"2019-04-28T02:29:00.250","lastModified":"2026-06-17T02:13:11.453","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password."},{"lang":"es","value":"Gitea, versiones anteriores a 1.8.0, permite 1FA para las cuentas de usuario que han completado la inscripción 2FA. Si se conocen las credenciales de un usuario, entonces un atacante podría enviarlas a la API sin requerir la contraseña única de 2FA."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.8.0","matchCriteriaId":"C13834C5-2DC2-4FBB-8069-671A9CAB9C3A"}]}]}],"references":[{"url":"https://blog.gitea.io/2019/04/gitea-1.8.0-is-released/","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/6674","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://blog.gitea.io/2019/04/gitea-1.8.0-is-released/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/6674","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-10330","sourceIdentifier":"jenkinsci-cert@googlegroups.com","published":"2019-05-31T15:29:00.590","lastModified":"2026-06-17T02:10:43.760","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted."},{"lang":"es","value":"En Plugin Gitea de Jenkins  versión 1.1.1 y anteriores, no fueron implementadas revisiones seguras, lo que permite a atacanter sin acceso comprometido al repositorio Git cambiar los archivos de Jenkins, inclusive si Jenkins se configuró para considerar que no son de confianza"}],"affected":[{"source":"jenkinsci-cert@googlegroups.com","affectedData":[{"vendor":"Jenkins project","product":"Jenkins Gitea Plugin","versions":[{"version":"1.1.1 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:jenkins:*:*","versionEndIncluding":"1.1.1","matchCriteriaId":"FAFFE9F0-F731-4624-89BF-DC40B3F1C00A"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/05/31/2","source":"jenkinsci-cert@googlegroups.com","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/108540","source":"jenkinsci-cert@googlegroups.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1046","source":"jenkinsci-cert@googlegroups.com","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/05/31/2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/108540","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1046","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2019-1010314","sourceIdentifier":"josh@bress.net","published":"2019-07-11T20:15:12.037","lastModified":"2026-06-17T02:09:58.573","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page."},{"lang":"es","value":"Gitea versiones 1.7.2, 1.7.3 está afectada por: Cross Site Scripting (XSS). El impacto es: ejecutar JavaScript en el navegador de la víctima, cuando la página repo vulnerable es cargada. El componente es: descripción del repositorio. El vector de ataque es: la víctima debe navegar en la página repo pública y afectada."}],"affected":[{"source":"josh@bress.net","affectedData":[{"vendor":"Gitea","product":"Gitea","versions":[{"version":"1.7.2, 1.7.3","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:1.7.2:*:*:*:*:*:*:*","matchCriteriaId":"7C8887C0-FE62-42B2-BF01-21DB9548A80B"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:1.7.3:*:*:*:*:*:*:*","matchCriteriaId":"AA4C163C-7718-4457-9FCE-9EE1B547BAE7"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/releases","source":"josh@bress.net","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-1010261","sourceIdentifier":"josh@bress.net","published":"2019-07-18T17:15:11.647","lastModified":"2026-06-17T02:09:55.487","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later."},{"lang":"es","value":"Gitea 1.7.0 y versiones anteriores se ven afectadas por: Cross Site Scripting (XSS). El impacto es: el atacante puede hacer que la víctima ejecute JS arbitrario en el navegador. El componente es: go-get URL generation - PR para corregir: https://github.com/go-gitea/gitea/pull/5905. El vector de ataque es: la víctima debe abrir una URL específicamente diseñada. La versión fija es: 1.7.1 y posteriores."}],"affected":[{"source":"josh@bress.net","affectedData":[{"vendor":"Gitea","product":"Gitea","versions":[{"version":"1.7.0 and earlier [fixed: 1.7.1 and later]","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndIncluding":"1.7.0","matchCriteriaId":"7BA016E0-7311-415E-A4C6-22E3A36D501C"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/pull/5905","source":"josh@bress.net","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/5905","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2020-13246","sourceIdentifier":"cve@mitre.org","published":"2020-05-20T18:15:12.667","lastModified":"2026-06-17T02:52:47.303","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another."},{"lang":"es","value":"Se detectó un problema en Gitea versiones hasta 1.11.5. Un atacante puede desencadenar un interbloqueo (deadlock) al iniciar una transferencia de una propiedad de repositorio de una organización a otra."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-667"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndIncluding":"1.11.5","matchCriteriaId":"6017D44E-852F-4935-B006-64BF03A9F091"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/issues/10549","source":"cve@mitre.org","tags":["Exploit","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/11438","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://www.youtube.com/watch?v=DmVgADSVS88","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/issues/10549","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/11438","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.youtube.com/watch?v=DmVgADSVS88","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2020-14144","sourceIdentifier":"cve@mitre.org","published":"2020-10-16T14:15:11.470","lastModified":"2026-06-17T02:54:17.050","vulnStatus":"Modified","cveTags":[{"sourceIdentifier":"cve@mitre.org","tags":["disputed"]}],"descriptions":[{"lang":"en","value":"The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states \"This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides."},{"lang":"es","value":"** EN DISPUTA ** La funcionalidad git hook en Gitea versiones 1.1.0 hasta 1.12.5 podría permitir la ejecución de código remoto autenticado en entornos de clientes donde la documentación no fue entendida (por ejemplo, un punto de vista es que la peligrosidad de esta característica debería ser documentada inmediatamente encima de la línea ENABLE_GIT_HOOKS en el archivo de configuración). NOTA: El proveedor ha indicado que no se trata de una vulnerabilidad y afirma: \"Se trata de una funcionalidad del software que se limita a un subconjunto muy limitado de cuentas\". Si le das a alguien el privilegio de ejecutar un código arbitrario en tu servidor, puede ejecutar un código arbitrario en tu servidor. Proporcionamos advertencias muy claras a los usuarios sobre esta funcionalidad y lo que proporciona."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionStartIncluding":"1.1.0","versionEndIncluding":"1.12.5","matchCriteriaId":"2522BAA2-9036-4157-B1CC-E2AE54DAD2C7"}]}]}],"references":[{"url":"http://packetstormsecurity.com/files/162122/Gitea-Git-Hooks-Remote-Code-Execution.html","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://docs.github.com/en/enterprise-server%402.19/admin/policies/creating-a-pre-receive-hook-script","source":"cve@mitre.org"},{"url":"https://docs.gitlab.com/ee/administration/server_hooks.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/PandatiX/CVE-2021-28378","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/PandatiX/CVE-2021-28378#notes","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/13058","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1125-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/162122/Gitea-Git-Hooks-Remote-Code-Execution.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://docs.github.com/en/enterprise-server%402.19/admin/policies/creating-a-pre-receive-hook-script","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://docs.gitlab.com/ee/administration/server_hooks.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/PandatiX/CVE-2021-28378","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/PandatiX/CVE-2021-28378#notes","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/13058","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1125-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2020-28991","sourceIdentifier":"cve@mitre.org","published":"2020-11-24T01:15:11.833","lastModified":"2026-06-17T03:10:56.777","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo_form.go."},{"lang":"es","value":"Gitea versiones 0.9.99 hasta 1.12.x anteriores a 1.12.6, no impide una ruta de protocolo git que especifica un número de puerto TCP y también contiene líneas nuevas (con codificación URL) en la función ParseRemoteAddr en el archivo modules/auth/repo_form.go"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionStartIncluding":"0.9.99","versionEndExcluding":"1.12.6","matchCriteriaId":"6F9A6ED6-3E4F-4272-AD70-C3723F91C563"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/pull/13525","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.12.6","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/13525","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.12.6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-3382","sourceIdentifier":"cve@mitre.org","published":"2021-02-05T16:15:12.820","lastModified":"2026-06-17T04:05:00.597","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path."},{"lang":"es","value":"Una vulnerabilidad de desbordamiento del búfer de la pila en gitea versiones 1.9.0 hasta 1.13.1, permite a atacantes remotos causar una denegación de servicio (bloqueo) por medio de vectores relacionados con una ruta de archivo"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionStartIncluding":"1.9.0","versionEndIncluding":"1.13.1","matchCriteriaId":"F2081EC6-EBD1-4509-BF9B-3B165DD1A251"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/pull/14390","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/14390","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-28378","sourceIdentifier":"cve@mitre.org","published":"2021-03-15T06:15:12.423","lastModified":"2026-06-17T03:46:18.380","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations."},{"lang":"es","value":"Gitea versiones 1.12.x y versiones 1.13.x anteriores a 1.13.4, permite un ataque de tipo XSS por medio de determinados datos de problemas en algunas situaciones"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionStartIncluding":"1.12.0","versionEndIncluding":"1.12.6","matchCriteriaId":"F12318F1-F60F-4F82-96FD-41FB2E36714F"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionStartIncluding":"1.13.0","versionEndExcluding":"1.13.4","matchCriteriaId":"79997226-230B-4DEF-8E0F-98D961399559"}]}]}],"references":[{"url":"https://blog.gitea.io/2021/03/gitea-1.13.4-is-released/","source":"cve@mitre.org","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/PandatiX/CVE-2021-28378","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/14898","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://blog.gitea.io/2021/03/gitea-1.13.4-is-released/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/PandatiX/CVE-2021-28378","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/14898","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-39867","sourceIdentifier":"cve@gitlab.com","published":"2021-10-05T13:15:07.977","lastModified":"2026-06-17T04:04:19.697","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF) attacks."},{"lang":"es","value":"En todas las versiones de GitLab CE/EE desde la versión 8.15, una vulnerabilidad de reenganche de DNS en Gitea Importer puede ser explotada por un atacante para desencadenar ataques de tipo Server Side Request Forgery (SSRF)"}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","versions":[{"version":">=8.15, <14.1.7","status":"affected"},{"version":">=14.2, <14.2.5","status":"affected"},{"version":">=14.3, <14.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:N","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"8.15.0","versionEndExcluding":"14.1.7","matchCriteriaId":"EE603FFD-D46C-43B0-81D9-F94954F64B52"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"8.15.0","versionEndExcluding":"14.1.7","matchCriteriaId":"F219D34C-E4FD-48FE-ADEF-2C86672AFC73"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"14.2.0","versionEndExcluding":"14.2.5","matchCriteriaId":"CAB23F69-59A2-430F-A082-A5F81A7A464C"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"14.2.0","versionEndExcluding":"14.2.5","matchCriteriaId":"CD7E2FAA-308F-450F-8990-52A7DEB8ED00"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:4.3.0:*:*:*:community:*:*:*","matchCriteriaId":"43C7D46F-A414-4818-B74C-547684E7B01D"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:4.3.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"35B8762D-58EF-4F52-9C12-6CA842F2E195"}]}]}],"references":[{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39867.json","source":"cve@gitlab.com","tags":["Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/214401","source":"cve@gitlab.com","tags":["Broken Link"]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39867.json","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/214401","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2021-45325","sourceIdentifier":"cve@mitre.org","published":"2022-02-08T15:15:07.727","lastModified":"2026-06-17T04:13:15.943","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL."},{"lang":"es","value":"Se presenta una vulnerabilidad de tipo Server Side Request Forgery (SSRF) en Gitea versiones anteriores a 1.7.0, usando URL de OpenID"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.7.0","matchCriteriaId":"449F0121-7275-40C5-9E63-7C703F88498E"}]}]}],"references":[{"url":"https://blog.gitea.io/2019/01/gitea-1.7.0-is-released/","source":"cve@mitre.org","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/5705","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://blog.gitea.io/2019/01/gitea-1.7.0-is-released/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/5705","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-45326","sourceIdentifier":"cve@mitre.org","published":"2022-02-08T15:15:07.767","lastModified":"2026-06-17T04:13:16.060","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests."},{"lang":"es","value":"Se presenta una vulnerabilidad de tipo Cross Site Request Forgery (CSRF) en Gitea versiones anteriores a 1.5.2, por medio de las rutas de la API. Esto puede ser peligroso especialmente con peticiones POST que alteran el estado"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.5.2","matchCriteriaId":"C6BA0450-9E23-485E-8E8D-DABAAB75F206"}]}]}],"references":[{"url":"https://blog.gitea.io/2018/10/gitea-1.5.2-is-released/","source":"cve@mitre.org","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/issues/4838","source":"cve@mitre.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/4840","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://blog.gitea.io/2018/10/gitea-1.5.2-is-released/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/issues/4838","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/4840","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-45327","sourceIdentifier":"cve@mitre.org","published":"2022-02-08T15:15:07.817","lastModified":"2026-06-17T04:13:16.173","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code."},{"lang":"es","value":"Gitea versiones anteriores a 1.11.2, está afectado por los Métodos de Permiso HTTP Confiables en el Lado del Servidor cuando hace referencia a la API de administración o de usuario vulnerable, lo que podría permitir a un usuario remoto malicioso ejecutar código arbitrario"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-436"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.11.2","matchCriteriaId":"500E7066-EE99-49E2-8F69-25376F8E626E"}]}]}],"references":[{"url":"https://blog.gitea.io/2020/03/gitea-1.11.2-is-released/","source":"cve@mitre.org","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/10462","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/10465","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/10582","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://blog.gitea.io/2020/03/gitea-1.11.2-is-released/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/10462","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/10465","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/10582","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-45328","sourceIdentifier":"cve@mitre.org","published":"2022-02-08T16:15:07.413","lastModified":"2026-06-17T04:13:16.290","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs."},{"lang":"es","value":"Gitea versiones anteriores a 1.4.3, está afectada por un Redireccionamiento de URLs a Sitios no Confiables (\"Open Redirect\") por medio de URLs internas"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-601"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.4.3","matchCriteriaId":"117B5786-635D-4D65-BE40-971E8B147C47"}]}]}],"references":[{"url":"https://blog.gitea.io/2018/06/release-of-1.4.3/","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/issues/4332","source":"cve@mitre.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://blog.gitea.io/2018/06/release-of-1.4.3/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/issues/4332","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-45329","sourceIdentifier":"cve@mitre.org","published":"2022-02-08T23:15:07.303","lastModified":"2026-06-17T04:13:16.407","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field."},{"lang":"es","value":"Se presenta una vulnerabilidad de tipo Cross Site Scripting (XSS) en Gitea versiones anteriores a 1.5.1 por medio de la configuración del repositorio dentro del campo URL del wiki/issue tracker externo"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.5.1","matchCriteriaId":"974565BB-6120-4C7D-90A8-F74254FF2A59"}]}]}],"references":[{"url":"https://blog.gitea.io/2018/09/gitea-1.5.1-is-released/","source":"cve@mitre.org","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/4710","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://blog.gitea.io/2018/09/gitea-1.5.1-is-released/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/4710","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-45330","sourceIdentifier":"cve@mitre.org","published":"2022-02-09T18:15:09.970","lastModified":"2026-06-17T04:13:16.520","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse."},{"lang":"es","value":"Se presenta un problema en Gitea hasta la versión 1.15.7, que podría permitir a un usuario malicioso alcanzar privilegios debido a que las cookies del lado del cliente no son eliminadas y la sesión sigue siendo válida en el lado del servidor para su reúso"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-459"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndIncluding":"1.15.7","matchCriteriaId":"75A73D91-9EDD-467B-AA77-B8C21F0946BE"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/issues/4336","source":"cve@mitre.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/issues/4336","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-45331","sourceIdentifier":"cve@mitre.org","published":"2022-02-09T18:15:10.013","lastModified":"2026-06-17T04:13:16.633","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once."},{"lang":"es","value":"Se presenta una vulnerabilidad de Omisión de Autenticación en Gitea versiones anteriores a 1.5.0, que podría permitir a un usuario malicioso alcanzar privilegios. Si es capturado, el código TOTP para la 2FA puede ser enviado correctamente más de una vez"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.5.0","matchCriteriaId":"A245EAFE-88C9-470E-9B7A-F8D32F25E2A2"}]}]}],"references":[{"url":"https://blog.gitea.io/2018/08/gitea-1.5.0-is-released/","source":"cve@mitre.org","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/3878","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://blog.gitea.io/2018/08/gitea-1.5.0-is-released/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/3878","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-29134","sourceIdentifier":"cve@mitre.org","published":"2022-03-15T21:15:07.997","lastModified":"2026-06-17T03:47:20.407","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL."},{"lang":"es","value":"El middleware de avatar en Gitea versiones anteriores a 1.13.6, permite un Salto de Directorio por medio de una URL diseñada"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.13.6","matchCriteriaId":"F9F4602B-6C47-470D-BD9F-2C72A97EC157"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/pull/15125/files","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.13.6","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/15125/files","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.13.6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-27313","sourceIdentifier":"cve@mitre.org","published":"2022-05-03T20:15:08.960","lastModified":"2026-06-17T04:36:55.213","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file."},{"lang":"es","value":"Una vulnerabilidad de eliminación de archivos arbitrarios en Gitea versión v1.16.3, permite a atacantes causar una denegación de servicio (DoS) por medio de la eliminación del archivo de configuración"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:1.16.3:*:*:*:*:*:*:*","matchCriteriaId":"CBDA4415-8FB9-487F-AE29-971848A522DC"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/pull/19072","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/19072","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-30781","sourceIdentifier":"cve@mitre.org","published":"2022-05-16T04:15:13.343","lastModified":"2026-06-17T04:44:17.033","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.16.7 does not escape git fetch remote."},{"lang":"es","value":"Gitea versiones anteriores a 1.16.7, no escapa de git fetch remote"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-116"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.16.7","matchCriteriaId":"2176FCB7-78CC-4472-A50B-1070AB750484"}]}]}],"references":[{"url":"http://packetstormsecurity.com/files/168400/Gitea-1.16.6-Remote-Code-Execution.html","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/169928/Gitea-Git-Fetch-Remote-Code-Execution.html","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://blog.gitea.io/2022/05/gitea-1.16.7-is-released/","source":"cve@mitre.org","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/19487","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/19490","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/168400/Gitea-1.16.6-Remote-Code-Execution.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/169928/Gitea-Git-Fetch-Remote-Code-Execution.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://blog.gitea.io/2022/05/gitea-1.16.7-is-released/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/19487","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/19490","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-38183","sourceIdentifier":"cve@mitre.org","published":"2022-08-12T20:15:09.940","lastModified":"2026-06-17T04:56:14.970","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles."},{"lang":"es","value":"En Gitea versiones anteriores a 1.16.9, era posible que usuarios añadieran incidencias existentes a los proyectos. Debido a controles de acceso inapropiados, un atacante podía asignar cualquier incidencia a cualquier proyecto en Gitea (no había comprobación de permisos para obtener la incidencia). Como resultado, el atacante podía acceder a títulos de las incidencias privadas."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.16.9","matchCriteriaId":"C3579D3E-0B48-4B91-9CAE-17E492E4B702"}]}]}],"references":[{"url":"https://blog.gitea.io/2022/07/gitea-1.16.9-is-released/","source":"cve@mitre.org","tags":["Release Notes","Vendor Advisory"]},{"url":"https://herolab.usd.de/security-advisories/usd-2022-0015/","source":"cve@mitre.org","tags":["Broken Link"]},{"url":"https://security.gentoo.org/glsa/202210-14","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://blog.gitea.io/2022/07/gitea-1.16.9-is-released/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://herolab.usd.de/security-advisories/usd-2022-0015/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"https://security.gentoo.org/glsa/202210-14","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-42968","sourceIdentifier":"cve@mitre.org","published":"2022-10-16T04:15:09.347","lastModified":"2026-06-17T05:05:41.230","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled."},{"lang":"es","value":"Gitea versiones anteriores a 1.17.3, no sanea ni escapa de las referencias en el backend de git. Los argumentos de los comandos de git son manejados inapropiadamente"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-05-14T14:33:59.973332Z","id":"CVE-2022-42968","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-88"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.17.3","matchCriteriaId":"ACEC293C-EEB4-4CCD-99D2-84BFD1D6ADD7"}]}]}],"references":[{"url":"https://github.com/go-gitea/gitea/pull/21463","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.17.3","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202210-14","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/21463","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.17.3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202210-14","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-46685","sourceIdentifier":"jenkinsci-cert@googlegroups.com","published":"2022-12-12T09:15:13.083","lastModified":"2026-06-17T05:12:11.730","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log."},{"lang":"es","value":"Jenkins Gitea Plugin 1.4.4 y versiones anteriores, la implementación de tokens de acceso personal de Gitea no admitía el enmascaramiento de credenciales, lo que podría exponerlas a través del registro de compilación."}],"affected":[{"source":"jenkinsci-cert@googlegroups.com","affectedData":[{"vendor":"Jenkins Project","product":"Jenkins Gitea Plugin","versions":[{"version":"unspecified","lessThanOrEqual":"1.4.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T13:57:16.100487Z","id":"CVE-2022-46685","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-319"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-319"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:jenkins:*:*","versionEndExcluding":"1.4.5","matchCriteriaId":"63309C5B-C1A2-4460-AA17-5F2CA020C690"}]}]}],"references":[{"url":"https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2661","source":"jenkinsci-cert@googlegroups.com","tags":["Vendor Advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2661","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2022-38795","sourceIdentifier":"cve@mitre.org","published":"2023-08-07T14:15:10.883","lastModified":"2026-06-17T04:57:11.150","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Gitea through 1.17.1, repo cloning can occur in the migration function."},{"lang":"es","value":"En Gitea hasta 1.17.1, la clonación de repositorios puede ocurrir en la función de migración."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-17T14:43:39.668288Z","id":"CVE-2022-38795","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndIncluding":"1.17.1","matchCriteriaId":"C4154BEE-8F3D-4CE3-A673-118157E92E62"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.17.2/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/20869","source":"cve@mitre.org","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/20892","source":"cve@mitre.org","tags":["Patch","Vendor Advisory"]},{"url":"https://blog.gitea.com/release-of-1.17.2/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/20869","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/20892","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2024-6886","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2024-08-06T04:16:46.653","lastModified":"2026-06-17T08:18:54.397","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0."},{"lang":"es","value":"Vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web (XSS o 'Cross-site Scripting') en Gitea Gitea Open Source Git Server permite XSS almacenado. Este problema afecta a Gitea Open Source Git Server: 1.22.0."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","repo":"https://github.com/go-gitea/gitea/","versions":[{"version":"1.22.0","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"gitea","product":"gitea","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitea:gitea:1.22.0:*:*:*:*:*:*:*"],"versions":[{"version":"1.22.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-08-06T14:26:58.912514Z","id":"CVE-2024-6886","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.22.1/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/31200","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2025-68938","sourceIdentifier":"cve@mitre.org","published":"2025-12-26T02:15:42.870","lastModified":"2026-10-13T10:10:00.193","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.25.2 mishandles authorization for deletion of releases."},{"lang":"es","value":"Gitea antes de 1.25.2 gestiona mal la autorización para la eliminación de versiones."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageURL":"pkg:golang/code.gitea.io/gitea","versions":[{"version":"0","lessThan":"1.25.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-26T14:42:22.299506Z","id":"CVE-2025-68938","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.25.2","matchCriteriaId":"7A45E0EE-B51F-48AE-9B89-EB27065D777B"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.2/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/36002/commits/d4262131b39899d9e9ee5caa2635c810d476e43f#diff-8962bac89952027d50fa51f31f59d65bedb4c02bde0265eced5cf256cbed306d","source":"cve@mitre.org","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.2","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2025-68939","sourceIdentifier":"cve@mitre.org","published":"2025-12-26T03:15:50.653","lastModified":"2026-10-13T10:10:00.193","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API."},{"lang":"es","value":"Gitea antes de 1.23.0 permite a los atacantes añadir adjuntos con extensiones de archivo prohibidas editando un nombre de adjunto a través de una API de adjuntos."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageURL":"pkg:golang/code.gitea.io/gitea","versions":[{"version":"0","lessThan":"1.23.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-26T14:40:06.574200Z","id":"CVE-2025-68939","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-424"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.23.0","matchCriteriaId":"6477BDC2-3013-450E-8A00-4AC462B1A1BD"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.23.0/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/32151","source":"cve@mitre.org","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.23.0","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2025-68940","sourceIdentifier":"cve@mitre.org","published":"2025-12-26T03:15:50.810","lastModified":"2026-10-13T10:10:00.193","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request."},{"lang":"es","value":"En Gitea antes de 1.22.5, los permisos de eliminación de ramas no se aplican adecuadamente después de fusionar una solicitud de extracción."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageURL":"pkg:golang/code.gitea.io/gitea","versions":[{"version":"0","lessThan":"1.22.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-26T14:42:20.321275Z","id":"CVE-2025-68940","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.22.5","matchCriteriaId":"B73C02B2-CC24-40B9-B2E4-DC50F100B352"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.22.5/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/32654","source":"cve@mitre.org","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.22.5","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2025-68941","sourceIdentifier":"cve@mitre.org","published":"2025-12-26T03:15:50.967","lastModified":"2026-10-13T10:10:00.193","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources."},{"lang":"es","value":"Gitea antes de 1.22.3 maneja incorrectamente el acceso a un recurso privado al recibir un token API con un alcance limitado a recursos públicos."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageURL":"pkg:golang/code.gitea.io/gitea","versions":[{"version":"0","lessThan":"1.22.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-26T19:31:26.862350Z","id":"CVE-2025-68941","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.22.3","matchCriteriaId":"3F93D132-969F-47BD-A092-6FDA641369BA"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.22.3/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/32218","source":"cve@mitre.org","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.22.3","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2025-68942","sourceIdentifier":"cve@mitre.org","published":"2025-12-26T03:15:51.117","lastModified":"2026-10-13T10:10:00.193","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text."},{"lang":"es","value":"Gitea antes de 1.22.2 permite XSS porque el cuadro de entrada de búsqueda (para crear etiquetas y ramas) es v-html en lugar de v-text."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageURL":"pkg:golang/code.gitea.io/gitea","versions":[{"version":"0","lessThan":"1.22.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-26T19:29:56.320510Z","id":"CVE-2025-68942","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.22.2","matchCriteriaId":"C44BF23A-21FB-4E86-84C7-CC1E52CA9B3F"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.22.2/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/31966","source":"cve@mitre.org","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.22.2","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2025-68943","sourceIdentifier":"cve@mitre.org","published":"2025-12-26T04:15:41.217","lastModified":"2026-10-13T10:10:00.193","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order."},{"lang":"es","value":"Gitea anterior a 1.21.8 divulga inadvertidamente los tiempos de inicio de sesión de los usuarios al permitir (por ejemplo) el orden de clasificación lastlogintime explore/users."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageURL":"pkg:golang/code.gitea.io/gitea","versions":[{"version":"0","lessThan":"1.21.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-26T19:28:50.288272Z","id":"CVE-2025-68943","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-497"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.21.8","matchCriteriaId":"B3B7DDB9-7510-4BA3-AA4D-86967058F7E0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.21.8-and-1.21.9-and-1.21.10/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/29430","source":"cve@mitre.org","tags":["Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.21.8","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2025-68944","sourceIdentifier":"cve@mitre.org","published":"2025-12-26T04:15:41.357","lastModified":"2026-10-13T10:10:00.193","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries."},{"lang":"es","value":"Gitea anterior a 1.22.2 a veces gestiona incorrectamente la propagación del alcance del token para el control de acceso dentro de uno de sus propios registros de paquetes."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageURL":"pkg:golang/code.gitea.io/gitea","versions":[{"version":"0","lessThan":"1.22.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-26T19:28:17.625511Z","id":"CVE-2025-68944","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.22.2","matchCriteriaId":"C44BF23A-21FB-4E86-84C7-CC1E52CA9B3F"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.22.2/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/31967","source":"cve@mitre.org","tags":["Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.22.2","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2025-68945","sourceIdentifier":"cve@mitre.org","published":"2025-12-26T04:15:41.507","lastModified":"2026-10-13T10:10:00.193","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Gitea before 1.21.2, an anonymous user can visit a private user's project."},{"lang":"es","value":"En Gitea antes de 1.21.2, un usuario anónimo puede visitar el proyecto de un usuario privado."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageURL":"pkg:golang/code.gitea.io/gitea","versions":[{"version":"0","lessThan":"1.21.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-26T14:49:16.693875Z","id":"CVE-2025-68945","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-359"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.21.2","matchCriteriaId":"031C3647-455E-4485-A65E-BEF163E55E04"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.21.2/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/28423","source":"cve@mitre.org","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.21.2","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2025-68946","sourceIdentifier":"cve@mitre.org","published":"2025-12-26T05:16:11.590","lastModified":"2026-10-13T10:10:00.193","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS."},{"lang":"es","value":"En Gitea antes de 1.20.1, un esquema de URL prohibido como javascript: puede ser utilizado para un enlace, también conocido como XSS."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageURL":"pkg:golang/code.gitea.io/gitea","versions":[{"version":"1.20.0","lessThan":"1.20.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-26T14:42:13.330951Z","id":"CVE-2025-68946","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"1.20.1","matchCriteriaId":"0B402030-21CD-43AD-8695-3236307900A2"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.20.1/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/25960","source":"cve@mitre.org","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.20.1","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2025-69413","sourceIdentifier":"cve@mitre.org","published":"2026-01-01T05:16:03.907","lastModified":"2026-10-14T19:10:00.297","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists."},{"lang":"es","value":"En Gitea antes de 1.25.2, /api/v1/user tiene respuestas diferentes para autenticación fallida dependiendo de si un nombre de usuario existe."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageURL":"pkg:golang/code.gitea.io/gitea","versions":[{"version":"0","lessThan":"1.25.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-05T19:55:52.705571Z","id":"CVE-2025-69413","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-204"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.25.2","matchCriteriaId":"47985DBC-D31A-447D-8CB1-C4ED389FF103"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.2/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/issues/35984","source":"cve@mitre.org","tags":["Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/36002","source":"cve@mitre.org","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.2","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2026-0798","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-01-22T22:16:15.957","lastModified":"2026-06-17T10:11:24.160","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content."},{"lang":"es","value":"Gitea puede enviar correos electrónicos de notificación de lanzamiento para repositorios privados a usuarios cuyo acceso ha sido revocado. Cuando un repositorio cambia de público a privado, los usuarios que previamente seguían el repositorio pueden seguir recibiendo notificaciones de lanzamiento, divulgando potencialmente títulos de lanzamiento, etiquetas y contenido."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-23T16:47:54.364105Z","id":"CVE-2026-0798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.25.4","matchCriteriaId":"DFCB7D74-331D-4582-AB41-113A25BE8FAA"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/36319","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.4","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f4wq-6ww5-m56p","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-20736","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-01-22T22:16:17.207","lastModified":"2026-07-15T02:18:23.973","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access."},{"lang":"es","value":"Gitea no verifica correctamente el contexto del repositorio al eliminar adjuntos. Un usuario que previamente subió un adjunto a un repositorio podría eliminarlo después de perder el acceso a ese repositorio al realizar la solicitud a través de un repositorio diferente al que puede acceder."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.3","versionType":"semver","status":"affected"}]}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","affectedData":[{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-opc-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-23T21:13:08.431490Z","id":"CVE-2026-20736","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.25.4","matchCriteriaId":"DFCB7D74-331D-4582-AB41-113A25BE8FAA"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/36320","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.4","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-jr6h-pwwp-c8g6","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Broken Link"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-20736","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2432205","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20736.json","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}]}},{"cve":{"id":"CVE-2026-20750","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-01-22T22:16:17.370","lastModified":"2026-07-15T02:18:24.173","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization."},{"lang":"es","value":"Gitea no valida correctamente la titularidad de los proyectos en las operaciones de proyectos de la organización. Un usuario con permisos de escritura en proyectos de una organización podría modificar proyectos pertenecientes a una organización diferente."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.3","versionType":"semver","status":"affected"}]}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","affectedData":[{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-opc-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-23T21:12:12.632348Z","id":"CVE-2026-20750","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.25.4","matchCriteriaId":"DFCB7D74-331D-4582-AB41-113A25BE8FAA"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/36318","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/36373","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.4","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-h4fh-pc4w-8w27","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Broken Link"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-20750","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2432216","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20750.json","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}]}},{"cve":{"id":"CVE-2026-20800","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-01-22T22:16:17.540","lastModified":"2026-06-17T10:17:48.227","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications."},{"lang":"es","value":"La API de notificaciones de Gitea no revalida los permisos de acceso al repositorio al devolver los detalles de la notificación. Después de que se revoque el acceso de un usuario a un repositorio privado, aún pueden ver los títulos de las incidencias y las solicitudes de extracción a través de notificaciones recibidas previamente."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-23T21:11:32.615971Z","id":"CVE-2026-20800","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.25.4","matchCriteriaId":"DFCB7D74-331D-4582-AB41-113A25BE8FAA"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/36339","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.4","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-g54m-9f6g-wj7q","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-20883","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-01-22T22:16:17.713","lastModified":"2026-06-17T10:17:59.390","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches."},{"lang":"es","value":"La API del cronómetro de Gitea no revalida los permisos de acceso al repositorio. Después de que se revoca el acceso de un usuario a un repositorio privado, aún pueden ver los títulos de las incidencias y los nombres de los repositorios a través de cronómetros iniciados previamente."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-23T21:11:00.973092Z","id":"CVE-2026-20883","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.25.4","matchCriteriaId":"DFCB7D74-331D-4582-AB41-113A25BE8FAA"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/36340","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/36368","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.4","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-644v-xv3j-xgqg","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-20888","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-01-22T22:16:17.890","lastModified":"2026-06-17T10:17:59.757","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users."},{"lang":"es","value":"Gitea no verifica correctamente la autorización al cancelar fusiones automáticas programadas a través de la interfaz web. Un usuario con acceso de lectura a las solicitudes de extracción podría cancelar fusiones automáticas programadas por otros usuarios."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-23T21:09:52.298236Z","id":"CVE-2026-20888","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.25.4","matchCriteriaId":"DFCB7D74-331D-4582-AB41-113A25BE8FAA"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/36341","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/36356","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.4","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-ccq9-c5hv-cf64","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-20897","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-01-22T22:16:18.960","lastModified":"2026-07-15T02:18:24.600","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories."},{"lang":"es","value":"Gitea no valida correctamente la propiedad del repositorio al eliminar bloqueos de Git LFS. Un usuario con acceso de escritura a un repositorio podría eliminar bloqueos LFS pertenecientes a otros repositorios."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.3","versionType":"semver","status":"affected"}]}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","affectedData":[{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-opc-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-23T17:56:55.236953Z","id":"CVE-2026-20897","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-639"}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.25.4","matchCriteriaId":"DFCB7D74-331D-4582-AB41-113A25BE8FAA"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/36344","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/36349","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.4","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-rrq5-r9h5-pc7c","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Broken Link"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-20897","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2432204","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20897.json","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}]}},{"cve":{"id":"CVE-2026-20904","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-01-22T22:16:19.130","lastModified":"2026-06-17T10:18:00.723","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities."},{"lang":"es","value":"Gitea no valida correctamente la titularidad al alternar la visibilidad de la URI de OpenID. Un usuario autenticado podría cambiar la configuración de visibilidad de las identidades OpenID de otros usuarios."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-23T17:52:05.088654Z","id":"CVE-2026-20904","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.25.4","matchCriteriaId":"DFCB7D74-331D-4582-AB41-113A25BE8FAA"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/36346","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/36361","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.4","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqx","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-20912","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-01-22T22:16:19.297","lastModified":"2026-07-15T02:18:24.963","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users."},{"lang":"es","value":"Gitea no valida correctamente la propiedad del repositorio al vincular adjuntos a las versiones. Un adjunto subido a un repositorio privado podría vincularse potencialmente a una versión en un repositorio público diferente, haciéndolo accesible a usuarios no autorizados."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.3","versionType":"semver","status":"affected"}]}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","affectedData":[{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-opc-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8","cpes":["cpe:/a:redhat:openshift_pipelines:1"]},{"vendor":"Red Hat","product":"OpenShift Pipelines","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9","cpes":["cpe:/a:redhat:openshift_pipelines:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-23T17:51:12.073308Z","id":"CVE-2026-20912","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-639"}]},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","description":[{"lang":"en","value":"CWE-283"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionEndExcluding":"1.25.4","matchCriteriaId":"DFCB7D74-331D-4582-AB41-113A25BE8FAA"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/36320","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/36355","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.4","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Broken Link"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-20912","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2432219","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20912.json","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}]}},{"cve":{"id":"CVE-2026-58053","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-06-28T02:16:32.420","lastModified":"2026-10-25T17:10:00.197","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a Docker-backed runner can create a job container with host namespaces and broad capabilities and escape to the host as root despite privileged mode being disabled."},{"lang":"es","value":"Gitea act_runner con el backend de Docker (a través de act 0.262.0) pasa una cadena container.options de un flujo de trabajo al HostConfig del contenedor de trabajo de Docker y, cuando se configura con privileged: false, fuerza la desactivación solo del indicador Privileged mientras fusiona opciones como --pid=host, --cap-add y --security-opt sin cambios. Un usuario que puede ejecutar un flujo de trabajo en un ejecutor respaldado por Docker puede crear un contenedor de trabajo con espacios de nombres de host y amplias capacidades y escapar al host como root a pesar de que el modo privilegiado esté deshabilitado."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Gitea","product":"act_runner","defaultStatus":"affected","versions":[{"version":"0","lessThanOrEqual":"0.262.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-30T14:12:40.647304Z","id":"CVE-2026-58053","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/bikini/exploitarium/tree/main/gitea-act-runner-container-options-poc","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gitea-act-runner-container-hardening-bypass-via-workflow-container-options","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-20706","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:56.433","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint."},{"lang":"es","value":"Las versiones de Gitea hasta e incluyendo la 1.26.1 permiten que las descargas de archivos de repositorio evadan las comprobaciones de alcance de token en el punto final de descarga de archivos web."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-06T18:34:03.677995Z","id":"CVE-2026-20706","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/37735","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-cr4g-f395-h25h","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-cr4g-f395-h25h","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-20779","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:56.543","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path."},{"lang":"es","value":"Las versiones de Gitea desde la 1.5.0 anteriores a la 1.26.3 tienen un defecto de aplicación de uso único de TOTP que permite que un código TOTP válido sea aceptado más de una vez a través de los flujos de autenticación de dos factores web y la ruta X-Gitea-OTP de autenticación básica."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"1.5.0","lessThan":"1.26.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-06T19:02:05.918693Z","id":"CVE-2026-20779","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-294"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38151","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-gx3v-q759-g323","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-gx3v-q759-g323","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-20896","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:56.660","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled."},{"lang":"es","value":"Las versiones de la imagen Docker de Gitea hasta e incluyendo la 1.26.2 usan REVERSE_PROXY_TRUSTED_PROXIES=* por defecto, permitiendo que cualquier IP de origen suplante la identidad de un usuario cuando los encabezados de autenticación de proxy inverso como X-WEBAUTH-USER están habilitados."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-06T19:03:07.590667Z","id":"CVE-2026-20896","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38151","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-20909","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:56.777","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries."},{"lang":"es","value":"Versiones de Gitea anteriores a la 1.25.5 tienen comprobaciones de permisos insuficientes al listar las entradas de tiempo registradas."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T15:35:26.263983Z","id":"CVE-2026-20909","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36662","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36744","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-22547","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:56.890","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values."},{"lang":"es","value":"Las versiones de Gitea anteriores a la 1.25.5 carecen de restricciones de validación para los campos de creación de repositorios, incluyendo campos de plantilla con límite de longitud y valores de modelo de confianza o formato de objeto."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T15:40:14.847970Z","id":"CVE-2026-22547","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36671","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36757","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-22555","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:57.023","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets."},{"lang":"es","value":"Las versiones de Gitea anteriores a la 1.26.0 permiten a los usuarios de la API bifurcar un repositorio en una organización sin pasar primero la verificación CanCreateOrgRepo, lo que puede exponer secretos de la organización."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.26.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-06T20:18:50.782565Z","id":"CVE-2026-22555","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36950","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fhx7-m96w-mv29","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fhx7-m96w-mv29","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-22874","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:57.157","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering."},{"lang":"es","value":"Las versiones de Gitea hasta la 1.26.2 inclusive tienen protección SSRF incompleta en el filtrado de listas de permitidos de webhooks y migración."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T15:44:30.434147Z","id":"CVE-2026-22874","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38059","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38173","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2r5c-gw76-rh3w","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2r5c-gw76-rh3w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-24451","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:57.280","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized."},{"lang":"es","value":"Gitea 1.26.2 permite que la sincronización de bifurcaciones continúe después de que un repositorio padre cambie de público a privado, exponiendo datos a una bifurcación que ya no debería estar autorizada."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"1.26.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T15:54:08.874718Z","id":"CVE-2026-24451","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38151","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-wrf9-r3h7-7x5v","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-wrf9-r3h7-7x5v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-24690","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:57.397","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches."},{"lang":"es","value":"Versiones de Gitea anteriores a la 1.25.5 tienen comprobaciones de permisos insuficientes para actualizar o rebasar ramas de solicitudes de extracción."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T15:57:50.582273Z","id":"CVE-2026-24690","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36465","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36838","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-25038","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:57.503","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea 1.26.2 allows unauthorized users to access labels of private organizations."},{"lang":"es","value":"Gitea 1.26.2 permite a usuarios no autorizados acceder a etiquetas de organizaciones privadas."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"1.26.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T16:01:47.338786Z","id":"CVE-2026-25038","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38151","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-v73x-hx65-6pf4","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-v73x-hx65-6pf4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-25712","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:57.607","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations."},{"lang":"es","value":"Versiones de Gitea anteriores a la 1.25.5 tienen comprobaciones de visibilidad insuficientes en las API de permisos de organización para miembros ocultos y organizaciones privadas."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T16:05:50.618787Z","id":"CVE-2026-25712","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36798","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36841","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-25714","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:57.707","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941."},{"lang":"es","value":"Las versiones de Gitea hasta la 1.26.1 inclusive no aplican el filtrado de tokens solo públicos de manera consistente a la API de organización de usuario, dejando una solución incompleta para CVE-2025-68941."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T15:33:18.306661Z","id":"CVE-2026-25714","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/37118","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8629-vc8r-5p58","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8629-vc8r-5p58","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-25718","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:57.823","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths."},{"lang":"es","value":"Las versiones de Gitea anteriores a la 1.25.5 manejan incorrectamente la resolución de rutas durante la generación de repositorios de plantilla, permitiendo que el procesamiento de plantillas lea o escriba a través de rutas con enlaces simbólicos o de otro modo no regulares."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T16:15:33.744373Z","id":"CVE-2026-25718","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36734","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36746","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-25779","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:57.923","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values."},{"lang":"es","value":"Las versiones de Gitea hasta la 1.25.4 inclusive permiten eludir redirecciones a través de barras invertidas sin procesar o codificadas por porcentaje en los valores de redirect_to."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T16:16:40.833772Z","id":"CVE-2026-25779","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36660","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36716","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-j5r2-4c8j-xc3m","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-j5r2-4c8j-xc3m","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-25782","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:58.030","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue."},{"lang":"es","value":"Las versiones de Gitea anteriores a la 1.25.5 buscan entradas de tiempo registrado por ID de tiempo sin acotar la búsqueda a la incidencia en la URL de la solicitud, permitiendo que los intentos de eliminación apunten a entradas de otra incidencia."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T16:19:59.416397Z","id":"CVE-2026-25782","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36664","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36689","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-26231","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:58.200","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write."},{"lang":"es","value":"Versiones de Gitea hasta la 1.26.1 inclusive permiten que la ruta de permiso ’Permitir ediciones de los mantenedores’ autorice confirmaciones a repositorios que el usuario puede leer pero en los que no debería poder escribir."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T14:44:56.666791Z","id":"CVE-2026-26231","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/37479","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/37484","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-26232","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:58.313","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange."},{"lang":"es","value":"Versiones de Gitea anteriores a 1.25.5 no aplican consistentemente la caducidad del código de autorización de OAuth2 y el comportamiento de uso único durante el intercambio de tokens."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T16:20:50.306165Z","id":"CVE-2026-26232","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-294"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36797","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36851","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-26247","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:58.417","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check."},{"lang":"es","value":"Las versiones de Gitea anteriores a la 1.25.5 no persisten correctamente el método de desafío OAuth2 PKCE S256 durante la autorización, permitiendo el intercambio de tokens sin la verificación del verificador esperada."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T16:21:34.783006Z","id":"CVE-2026-26247","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36462","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36477","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-26292","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:58.517","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests."},{"lang":"es","value":"Las versiones de Gitea anteriores a la 1.25.5 no utilizan el transporte HTTP de migración para las operaciones de push de LFS y de espejo de sincronización, eludiendo las protecciones de transporte de migración configuradas para esas solicitudes de LFS."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T16:23:15.727970Z","id":"CVE-2026-26292","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36665","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36691","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-26307","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:58.620","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources."},{"lang":"es","value":"Las versiones de Gitea anteriores a la 1.25.5 no aplican un tiempo de espera en las búsquedas de git grep, permitiendo que búsquedas costosas consuman recursos del servidor."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-09T14:16:00.503287Z","id":"CVE-2026-26307","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36809","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36835","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-27657","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:58.720","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 allow a user to change another user's primary email address."},{"lang":"es","value":"Versiones de Gitea anteriores a la 1.25.5 permiten a un usuario cambiar la dirección de correo electrónico principal de otro usuario."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T16:26:20.596508Z","id":"CVE-2026-27657","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36586","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36607","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-27660","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:58.830","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission."},{"lang":"es","value":"Versiones de Gitea anteriores a la 1.25.5 permiten que los datos de versiones preliminares o los adjuntos sean accedidos sin el permiso de escritura requerido."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T16:27:04.135160Z","id":"CVE-2026-27660","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36659","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36715","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-27761","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:58.937","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope."},{"lang":"es","value":"Las versiones de Gitea hasta la 1.26.2 inclusive permiten que los puntos finales de los feeds RSS y Atom del repositorio omitan las comprobaciones de alcance de los tokens de acceso de la API, exponiendo datos de commits de repositorios privados a tokens sin el alcance de repositorio requerido."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T14:36:41.805084Z","id":"CVE-2026-27761","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38147","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-3pww-vcvm-3gmj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-27771","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:59.043","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information."},{"lang":"es","value":"Las versiones de Gitea hasta la 1.26.1 inclusive presentan comprobaciones de permisos insuficientes para los enlaces de origen de paquetes de Composer, lo que puede exponer información de origen de paquetes privada o interna."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T14:32:50.774085Z","id":"CVE-2026-27771","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/37610","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8qw8-rq86-9pc2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-27775","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:59.157","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access."},{"lang":"es","value":"Gitea 1.25.5 almacena en caché un resultado de permiso de escritura específico de la rama a través de múltiples refs en una sesión de hook pre-recepción, permitiendo que una concesión de edición de mantenedor por rama sea reutilizada para otras refs y escale a acceso de escritura completo al repositorio."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-06T15:25:11.861993Z","id":"CVE-2026-27775","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38151","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-649p-mmhf-85c7","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-649p-mmhf-85c7","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-27779","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:59.257","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation."},{"lang":"es","value":"Versiones de Gitea anteriores a la 1.25.5 aceptan valores forwarded-proto malformados o inyectados al detectar URLs públicas, permitiendo la generación de URLs canónicas falsificadas."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-06T15:20:57.587413Z","id":"CVE-2026-27779","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36810","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36836","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-27780","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:59.347","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks."},{"lang":"es","value":"Las versiones de Gitea anteriores a la 1.26.0 no fallan en modo cerrado ante errores de bufio.Scanner al procesar la entrada del hook de pre-recepción, permitiendo que una entrada sobredimensionada eluda las comprobaciones de protección de ramas."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.26.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-06T15:20:00.746843Z","id":"CVE-2026-27780","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36963","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-27783","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:59.450","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints."},{"lang":"es","value":"Las versiones de Gitea hasta la 1.26.1 inclusive no aplican la autorización a nivel de repositorio en los puntos finales de la API de plantillas de incidencias."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-06T15:19:08.199875Z","id":"CVE-2026-27783","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/37769","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/37781","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-3fwp-p5rj-2pxf","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-3fwp-p5rj-2pxf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-28699","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:59.567","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication."},{"lang":"es","value":"Las versiones de Gitea hasta la 1.26.1 inclusive permiten que la aplicación del alcance del token de acceso OAuth2 sea eludida a través de la autenticación básica HTTP."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-06T15:18:36.564092Z","id":"CVE-2026-28699","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/37503","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-28705","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:59.683","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths."},{"lang":"es","value":"Las versiones de Gitea anteriores a la 1.25.5 utilizan nombres de etiquetas de lanzamiento y nombres de activos como componentes de ruta del sistema de archivos al volcar activos de lanzamiento, permitiendo que nombres especialmente diseñados afecten las rutas de salida del volcado."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.25.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T16:28:13.742574Z","id":"CVE-2026-28705","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.25.5/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36799","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/36839","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.25.5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-28737","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:59.787","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer."},{"lang":"es","value":"Las versiones de Gitea desde la 1.25.0 anteriores a la 1.26.0 permiten cross-site scripting almacenado a través del campo extensionsRequired en archivos glTF renderizados por el visor de archivos 3D."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"1.25.0","lessThan":"1.26.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T13:48:02.139792Z","id":"CVE-2026-28737","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/37233","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-28740","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:16:59.890","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access."},{"lang":"es","value":"Las versiones de Gitea hasta e incluyendo la 1.26.2 permiten la reutilización de objetos Git LFS para autorizar objetos de origen privados para usuarios que tienen acceso al repositorio pero carecen de acceso a la unidad de código."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-07T13:47:46.184675Z","id":"CVE-2026-28740","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38050","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2m9v-5q2g-58vq","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-28744","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:17:00.003","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks."},{"lang":"es","value":"Las versiones de Gitea hasta la 1.26.1 inclusive permiten que las solicitudes HTTP inteligentes de Git autenticadas con tokens de portador omitan las comprobaciones de alcance de los tokens del repositorio."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-06T15:17:54.973827Z","id":"CVE-2026-28744","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/37583","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-cc8w-r4qh-3v65","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-cc8w-r4qh-3v65","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-58426","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-07-03T21:17:05.770","lastModified":"2026-10-25T15:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write"},{"lang":"es","value":"La ambigüedad de HMAC en la URL firmada de Gitea Actions Artifacts V4 permite la lectura de artefactos entre repositorios y la escritura del estado de carga entre tareas."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"1.22.0","lessThanOrEqual":"1.26.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-06T15:07:14.581616Z","id":"CVE-2026-58426","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.26.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/37707","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-hg5r-vq93-9fv6","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-hg5r-vq93-9fv6","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-34966","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-05T21:16:58.187","lastModified":"2026-10-08T16:17:13.850","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"affected","packageURL":"pkg:golang/code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.26.4","versionType":"semver","status":"affected"},{"version":"1.27.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-06T14:40:52.489334Z","id":"CVE-2026-34966","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/go-gitea/gitea","source":"disclosure@vulncheck.com"},{"url":"https://github.com/go-gitea/gitea/commit/b969123b7fac51c88daab5cb64e5b2f4abd53288","source":"disclosure@vulncheck.com"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gitea-prior-to-ssrf-via-migration-uri-fetch-bypass","source":"disclosure@vulncheck.com"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-72867","sourceIdentifier":"security-advisories@github.com","published":"2026-08-10T19:17:35.443","lastModified":"2026-09-08T20:54:37.790","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Dokploy","product":"dokploy","versions":[{"version":">= 0.29.3, < 0.29.13","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-13T17:34:27.352944Z","id":"CVE-2026-72867","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-602"}]}],"references":[{"url":"https://github.com/Dokploy/dokploy/commit/47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bc","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/pull/4855","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/releases/tag/v0.29.13","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-cg8g-x23v-5fw8","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-cg8g-x23v-5fw8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-56657","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-08-13T17:17:25.470","lastModified":"2026-08-26T16:53:48.300","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea SSH Key Parser Denial of Service"}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-13T18:48:47.165858Z","id":"CVE-2026-56657","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/gitea-1.27.0-is-released/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-4xjf-493q-98p3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-56750","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-08-13T17:17:25.577","lastModified":"2026-08-26T16:53:48.300","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea Remember-Me Token Theft Not Invalidating Attacker Session"}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-14T19:17:41.030980Z","id":"CVE-2026-56750","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/gitea-1.27.0-is-released/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-rgv6-xp99-6mgj","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-58314","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-08-13T17:17:26.193","lastModified":"2026-08-26T16:53:48.300","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Two SSRF findings in Gitea 1.26.2"}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-14T17:35:35.418926Z","id":"CVE-2026-58314","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://blog.gitea.com/gitea-1.27.0-is-released/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2fcr-jfvc-vgg2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2fcr-jfvc-vgg2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-58435","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-08-13T17:17:27.490","lastModified":"2026-08-26T16:53:48.300","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea LFS Deploy-Key Privilege Escalation"}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-14T17:20:18.791594Z","id":"CVE-2026-58435","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://blog.gitea.com/gitea-1.27.0-is-released/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-rh79-75qm-gwjr","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-rh79-75qm-gwjr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-58508","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-08-13T17:17:28.757","lastModified":"2026-08-26T16:53:48.300","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)"}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-14T19:04:24.902083Z","id":"CVE-2026-58508","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/gitea-1.27.0-is-released/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-j72v-mjr6-3424","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-59763","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-08-13T17:17:30.360","lastModified":"2026-10-24T16:10:00.153","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads"},{"lang":"es","value":"Metadatos de archivo de paquete Arch ilimitados pueden causar amplificación de recursos en las cargas de paquetes de Gitea"}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Open Source Git Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-13T18:49:35.272039Z","id":"CVE-2026-59763","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/gitea-1.27.0-is-released/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-60004","sourceIdentifier":"cve@mitre.org","published":"2026-08-26T20:17:56.010","lastModified":"2026-08-27T11:41:19.230","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","versions":[{"version":"1.17","lessThan":"1.27.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-26T20:21:46.783249Z","id":"CVE-2026-60004","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-08-25","cisaActionDue":"2026-08-28","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Gitea Code Injection Vulnerability","weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*","versionStartIncluding":"1.17.0","versionEndExcluding":"1.27.1","matchCriteriaId":"2F773281-54C1-45F3-A53A-1638FC28E83E"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.1/","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://github.com/0xBlackash/CVE-2026-60004","source":"cve@mitre.org","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m","source":"cve@mitre.org","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.runzero.com/blog/gitea/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}},{"cve":{"id":"CVE-2026-86059","sourceIdentifier":"security-advisories@github.com","published":"2026-09-22T17:17:27.690","lastModified":"2026-09-22T18:17:24.473","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider rows without applying getAccessibleGitProviderIds or an organization check. The application.one route also returns nested GitHub, GitLab, Gitea, and Bitbucket relations from findApplicationById with GitHub App private keys, OAuth tokens, client secrets, webhook secrets, and app passwords even when hasGitProviderAccess is false. A member with application read access or a provider identifier can therefore bypass per-member provider assignment and use the exposed credentials to access private repositories or manipulate external workflows. This issue is fixed in version 0.29.13."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Dokploy","product":"dokploy","versions":[{"version":"< 0.29.13","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-22T17:11:02.101522Z","id":"CVE-2026-86059","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/Dokploy/dokploy/commit/ecbaf6060bf6d00491ee51086e28258979777226","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/pull/4859","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/releases/tag/v0.29.13","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-wx75-vxph-2m2f","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-wx75-vxph-2m2f","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104976","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:32.913","lastModified":"2026-10-06T15:17:13.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call validate_url(). In addition, avatar_url is taken from the Gitea user's profile, where users can configure external avatar URLs. After an administrator enables Gitea OAuth for a legitimate instance, a Gitea user can set an internal URL as the profile avatar and log in through Gitea, causing Plane to fetch the internal target without validation. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:19.095347Z","id":"CVE-2026-104976","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9163","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-hx79-5pj5-qh42","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105640","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:18.383","lastModified":"2026-10-05T19:17:18.520","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:32:52.620033Z","id":"CVE-2026-105640","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/b91b61c379908d9e451613dbca23fc3803e926d2","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9289","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-7j95-vh8g-f365","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-7j95-vh8g-f365","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-101027","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:08.233","lastModified":"2026-10-15T02:32:39.673","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or private addresses and bypass `ALLOW_LOCALNETWORKS = false`, reaching internal services from the Gitea server. Instances without `ALLOWED_DOMAINS` configured are not affected by this specific bypass."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T11:37:40.968109Z","id":"CVE-2026-101027","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39426","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fqjr-23c8-gg9m","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-101029","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:08.647","lastModified":"2026-10-15T02:29:40.883","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct the server to internal services, reading from and writing to reachable internal Git or HTTP endpoints. Content from internal responses could additionally be disclosed through migration and mirror error messages."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:17:52.447255Z","id":"CVE-2026-101029","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-209"},{"lang":"en","value":"CWE-367"},{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39010","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/39426","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-6g2h-xpg3-rm48","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103059","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:14.377","lastModified":"2026-10-15T02:26:26.567","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:17:16.900412Z","id":"CVE-2026-103059","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-305"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39423","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8pwg-hcgm-54cp","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103667","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:14.607","lastModified":"2026-10-15T02:25:29.217","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a `text/html` media type. When a victim who is authenticated to the instance opens the blob URL in a browser, the script runs on the Gitea origin and can perform actions as the victim, such as creating API tokens."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:16:50.727435Z","id":"CVE-2026-103667","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39398","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7cq7-4v93-8wjm","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103670","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:14.717","lastModified":"2026-10-15T02:23:07.507","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from a fork could cancel trusted in-progress runs that share a concurrency group with `cancel-in-progress` enabled, without approval and without running any code. On self-hosted runners this can interrupt deployments and leave partial state behind."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:55:33.888984Z","id":"CVE-2026-103670","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-667"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39399","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-4j4g-m7mr-hp5j","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104626","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:15.120","lastModified":"2026-10-13T17:24:53.250","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:19:04.289390Z","id":"CVE-2026-104626","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-841"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39399","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-93pj-3x56-5gc2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104632","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:15.237","lastModified":"2026-10-13T17:20:01.013","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access cancelled a run that was awaiting approval and then re-ran it, the new jobs were created as waiting rather than blocked while the run still recorded that approval was required. Cancelling and re-running stale fork checks is a routine action that does not involve the approval control, so where Actions is enabled and a matching runner is registered, workflow code taken from the fork pull request head could run on the repository's runners without an explicit approval."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:20:48.432483Z","id":"CVE-2026-104632","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39399","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-pvjf-7jrm-6w9g","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104636","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:15.343","lastModified":"2026-10-13T17:18:49.457","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects could make Gitea's Git client send requests to an address that the outbound host policy would otherwise block. The impact depends on the configured policy and the internal services reachable from the server."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:13:39.303785Z","id":"CVE-2026-104636","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39426","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-g4hw-fg4c-89mq","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-70357","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:28.883","lastModified":"2026-10-13T17:16:32.907","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between validation and connection to reach a blocked internal address. The affected path is the Git clone operation; validation in the migration HTTP client's dialer does not protect the independently connecting Git subprocess."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:12:28.154573Z","id":"CVE-2026-70357","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39426","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-p3pc-g8m5-hrrr","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73278","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:29.000","lastModified":"2026-10-13T16:53:31.257","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"1.16.0","lessThanOrEqual":"1.27.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:00:20.177733Z","id":"CVE-2026-73278","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionStartIncluding":"1.16.0","versionEndExcluding":"1.27.2","matchCriteriaId":"9C549557-A5A6-4F5E-A085-791209EEA87E"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/38805","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/38810","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-92j2-6qcg-c28c","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-79960","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:33.660","lastModified":"2026-10-13T16:51:21.447","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and change repository visibility through push options, for example making a private repository public. Pull requests created through the AGit flow with a deploy key were also attributed to the owner."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:20:37.099663Z","id":"CVE-2026-79960","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/37306","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7769-9pr9-m24h","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-89430","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:34.297","lastModified":"2026-10-13T16:46:04.457","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a blocked or internal address was still reached. A user with administrator access to a repository, which includes repositories they create themselves, could aim push mirror synchronization at internal Git services and force-push the repository's contents to them."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:15:42.946496Z","id":"CVE-2026-89430","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-367"},{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39010","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/39426","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-hcgw-r9gf-8mph","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-94205","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:34.733","lastModified":"2026-10-13T16:41:45.587","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:11:31.504995Z","id":"CVE-2026-94205","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-441"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39399","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-xh39-mxw9-34pp","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-95106","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:34.867","lastModified":"2026-10-13T16:27:19.200","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:07:25.322446Z","id":"CVE-2026-95106","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-706"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39472","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-6pv5-8rp7-8c75","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-95112","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:34.963","lastModified":"2026-10-13T15:36:44.343","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as \"closes\" or \"fixes\" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of about 1 MB that keeps a CPU core busy for several minutes while holding a database transaction open."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T12:25:19.083201Z","id":"CVE-2026-95112","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39396","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-467c-4w7p-8427","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96399","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:35.270","lastModified":"2026-10-13T15:36:39.100","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings could make any later rendering of matching content, such as viewing a README, crash the instance for all users."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:10:08.050555Z","id":"CVE-2026-96399","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-248"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39354","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mw6q-qj47-9g5q","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96400","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:35.387","lastModified":"2026-10-13T15:36:19.913","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as `169.254.169.254`, even when `ALLOW_LOCALNETWORKS = false`. The local-network block list did not cover these ranges, and a hostname matching the allow list was accepted regardless of its resolved address. A user who can start migrations on such an instance could reach these addresses from the Gitea server; the default empty `ALLOWED_DOMAINS` configuration is not affected."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T11:35:23.694637Z","id":"CVE-2026-96400","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39426","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-54w9-6cc5-9wj9","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96404","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:35.500","lastModified":"2026-10-13T15:36:13.843","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:26:36.461394Z","id":"CVE-2026-96404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39400","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9h7g-h754-c8x2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96580","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:35.600","lastModified":"2026-10-13T15:36:06.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large number of jobs, consuming server memory and potentially terminating the Gitea process. No runner is required. Static matrices above 256 combinations are now rejected before expansion."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:09:08.500896Z","id":"CVE-2026-96580","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39295","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-p3rv-cr5f-9gjh","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96589","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:35.710","lastModified":"2026-10-13T15:36:00.433","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The repository owner was not notified. Transfer-granted access is now removed while collaborations that existed before the transfer are preserved."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:29:18.292283Z","id":"CVE-2026-96589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-672"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39042","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-xfqq-h54g-92f8","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-101023","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:16:59.737","lastModified":"2026-10-13T14:39:07.980","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:03:22.628993Z","id":"CVE-2026-101023","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.1.0","matchCriteriaId":"A392C59B-D9D1-41C2-BBEC-C0E388C35439"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-469m-x4mw-38r3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104633","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:01.200","lastModified":"2026-10-13T14:38:56.493","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:51:08.820853Z","id":"CVE-2026-104633","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.1.0","matchCriteriaId":"A392C59B-D9D1-41C2-BBEC-C0E388C35439"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-jj5r-9rpc-8h6h","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105267","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:02.253","lastModified":"2026-10-13T14:38:48.423","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:02:28.853973Z","id":"CVE-2026-105267","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-732"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.1.0","matchCriteriaId":"A392C59B-D9D1-41C2-BBEC-C0E388C35439"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-vvqw-mjq8-x248","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105268","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:02.377","lastModified":"2026-10-13T14:38:35.583","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:09:19.965265Z","id":"CVE-2026-105268","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.1.0","matchCriteriaId":"A392C59B-D9D1-41C2-BBEC-C0E388C35439"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-96qg-qxxj-r8xq","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86684","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:07.570","lastModified":"2026-10-13T18:05:50.717","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"1.18.0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:05:48.076581Z","id":"CVE-2026-86684","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionStartIncluding":"1.18.0","versionEndExcluding":"28.1.0","matchCriteriaId":"D4547B13-CEBE-486D-99F6-426D24328126"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7v5j-mph8-9w6g","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-89182","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:07.690","lastModified":"2026-10-13T18:03:37.053","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"1.27.0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T11:33:52.355355Z","id":"CVE-2026-89182","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionStartIncluding":"1.27.0","versionEndExcluding":"28.1.0","matchCriteriaId":"C6BE01FE-1756-403D-AA0E-FAF561831D0A"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fx95-gwfc-grgc","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fx95-gwfc-grgc","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96594","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:07.810","lastModified":"2026-10-13T17:59:22.620","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:04:06.630412Z","id":"CVE-2026-96594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.1.0","matchCriteriaId":"A392C59B-D9D1-41C2-BBEC-C0E388C35439"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-94rx-fqm6-q23v","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-97208","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:07.927","lastModified":"2026-10-13T17:56:32.037","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:04:45.452755Z","id":"CVE-2026-97208","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.1.0","matchCriteriaId":"A392C59B-D9D1-41C2-BBEC-C0E388C35439"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8hhh-mqpg-jpxc","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-25946","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:19.393","lastModified":"2026-10-14T16:17:45.377","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"1.25.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T15:50:37.206123Z","id":"CVE-2026-25946","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/go-gitea/gitea/pull/36729","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9574-292w-9wmw","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-59766","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:20.577","lastModified":"2026-10-14T16:17:46.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"1.25.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T15:31:00.508506Z","id":"CVE-2026-59766","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/go-gitea/gitea/pull/38324","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-qf2f-qh6p-7v89","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-59774","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:20.677","lastModified":"2026-10-15T04:18:24.663","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"1.22","lessThan":"1.27.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T00:00:00+00:00","id":"CVE-2026-59774","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.1/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38642","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38645","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.1","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556r","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"http://www.openwall.com/lists/oss-security/2026/08/10/3","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-60008","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:20.787","lastModified":"2026-10-14T16:17:47.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"1.27.0","lessThanOrEqual":"1.27.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T15:26:00.086757Z","id":"CVE-2026-60008","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-1021"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38793","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38795","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7452-653r-6gp8","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-60010","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:20.897","lastModified":"2026-10-15T04:18:24.870","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T00:00:00+00:00","id":"CVE-2026-60010","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39046","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39058","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-g5jj-gp8w-73h7","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-60018","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:21.020","lastModified":"2026-10-14T16:17:47.467","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or never-ending response. This can consume memory and hold migration workers, impairing service availability."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"1.16.0","lessThan":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T15:21:20.982248Z","id":"CVE-2026-60018","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39024","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39033","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-46px-6cqx-c5fv","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-60021","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:21.120","lastModified":"2026-10-18T14:16:55.100","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"1.16.0","lessThan":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-18T13:30:24.038745Z","id":"CVE-2026-60021","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39023","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39035","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-5952-x23q-p23f","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-62925","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:21.230","lastModified":"2026-10-14T16:17:47.760","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionately large memory allocations during parsing and metadata generation. On memory-constrained deployments, this can terminate the process or otherwise disrupt availability."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T15:20:50.714336Z","id":"CVE-2026-62925","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39026","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39029","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-36q5-5423-vgx2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-63021","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:21.330","lastModified":"2026-10-14T16:17:47.903","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause request failures."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T15:19:39.273675Z","id":"CVE-2026-63021","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39025","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39032","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fqxf-w92m-prvq","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-63792","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:21.430","lastModified":"2026-10-14T16:17:49.657","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through collaborative-owner configuration. The issue exposes private reusable workflow contents at caller-selected Git refs; it does not itself grant write access or code execution in the other repository."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T15:19:07.781064Z","id":"CVE-2026-63792","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-280"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39005","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39018","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2xph-7j4g-43rg","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-66849","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:21.547","lastModified":"2026-10-14T16:17:50.117","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects user-owned package registries and exposes package contents across the intended authorization boundary."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T15:18:20.592494Z","id":"CVE-2026-66849","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39043","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39058","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-px3q-x2mm-55wg","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-66853","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:21.653","lastModified":"2026-10-14T16:17:50.263","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T15:17:20.621835Z","id":"CVE-2026-66853","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39047","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39058","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-w4wc-g858-3672","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-66874","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:21.760","lastModified":"2026-10-14T16:17:50.407","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from running. Because skipped statuses count as success, branch protection or organization-required workflow checks can appear satisfied without the mandated workflow executing; no runner or maintainer approval is required for this path."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T15:12:30.376099Z","id":"CVE-2026-66874","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-345"},{"lang":"en","value":"CWE-693"},{"lang":"en","value":"CWE-807"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39005","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39018","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-5xp7-r6cr-39ff","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-66877","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:21.863","lastModified":"2026-10-15T04:18:25.113","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T00:00:00+00:00","id":"CVE-2026-66877","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39005","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39018","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-v2w8-m4gr-qj65","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-67577","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:21.963","lastModified":"2026-10-14T16:17:51.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity can include repository names, commit messages, and issue or pull request events associated with qualifying public-repository activity."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"Gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T15:02:40.472099Z","id":"CVE-2026-67577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39004","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39039","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-rfm6-r2x5-cg56","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-68957","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:22.063","lastModified":"2026-10-14T16:17:51.327","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also reveal that hidden issue content or comments contain a supplied term."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"Gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T15:01:43.951406Z","id":"CVE-2026-68957","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39004","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39039","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-wg93-gp4m-c6vr","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-68964","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:22.160","lastModified":"2026-10-14T16:17:51.477","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key material and associated metadata, not private cryptographic keys."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"Gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T14:56:47.203246Z","id":"CVE-2026-68964","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39004","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39039","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-wwmh-7r9x-fg49","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-70396","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:22.257","lastModified":"2026-10-18T14:16:55.260","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-18T13:30:49.756117Z","id":"CVE-2026-70396","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39007","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39014","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-hxhc-246f-rvqc","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-70400","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:22.363","lastModified":"2026-10-14T16:17:51.783","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that user has the necessary permissions. The ordinary private repository-creation route rejects the same token, but the migration path omits that restriction."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T14:56:12.099907Z","id":"CVE-2026-70400","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39007","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39014","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-x58h-3mx5-q44r","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-70402","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:22.467","lastModified":"2026-10-14T16:17:51.930","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.0,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T14:55:28.839489Z","id":"CVE-2026-70402","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39008","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39016","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-pq8x-xpgp-rvmh","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-70406","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:22.570","lastModified":"2026-10-14T16:17:52.077","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head repository accessible to the token owner. This bypasses the token's public-only restriction; it does not remove the account's underlying repository permission checks."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T14:54:29.357945Z","id":"CVE-2026-70406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39006","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39013","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-m78w-jjjx-gp8r","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-70407","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:22.677","lastModified":"2026-10-14T16:17:52.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassing the intended restriction on the token's delegated access."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"Gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T14:53:49.759761Z","id":"CVE-2026-70407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39041","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39058","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-ww9q-7j5q-hrv5","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-71184","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:22.783","lastModified":"2026-10-15T04:18:25.337","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"1.20.0","lessThanOrEqual":"1.27.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T00:00:00+00:00","id":"CVE-2026-71184","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39005","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39018","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7w2r-xwp6-mh6c","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-71301","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:22.887","lastModified":"2026-10-14T16:17:52.500","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a private repository can submit a markup preview request and retrieve a private pull request's title and state icon despite lacking Issues and Pull Requests access. This exposes pull request metadata across repository unit permissions."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T14:48:36.049663Z","id":"CVE-2026-71301","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39045","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39054","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-5w72-2mqm-qh46","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-73126","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:23.083","lastModified":"2026-10-14T16:17:52.647","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository accessible to its owner. This discloses private workflow status beyond the token's intended delegated permissions."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"Gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T14:46:45.656357Z","id":"CVE-2026-73126","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39044","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39058","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-r96c-jc75-rxv6","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-73130","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:23.190","lastModified":"2026-10-14T16:17:52.790","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can submit an oversized value to amplify template reads and memory use, impairing availability."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T14:46:25.652253Z","id":"CVE-2026-73130","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39027","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39040","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8r3w-5682-jrqf","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-73135","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:23.300","lastModified":"2026-10-14T16:17:52.930","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes correctly deny access with a 404 response. The issue exposes repository existence and listing information across the intended owner-visibility boundary."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T14:43:48.993690Z","id":"CVE-2026-73135","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39009","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39012","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-hch4-r2j8-xm72","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-73273","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:23.410","lastModified":"2026-10-14T16:17:53.353","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This bypasses the upload quota on that path and can exhaust server memory."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T14:43:29.972852Z","id":"CVE-2026-73273","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39028","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39031","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-5xcq-p92v-43rf","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-73535","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:23.517","lastModified":"2026-10-18T14:16:55.403","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-18T13:31:49.410645Z","id":"CVE-2026-73535","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-304"},{"lang":"en","value":"CWE-696"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38805","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38810","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8xjr-x7rg-hp5h","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-73539","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:23.633","lastModified":"2026-10-18T14:16:55.550","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea","versions":[{"version":"0","lessThanOrEqual":"1.27.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-18T13:32:47.376516Z","id":"CVE-2026-73539","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38885","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38898","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-579w-82gf-89m2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-73800","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:24.560","lastModified":"2026-10-18T14:16:55.687","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea/gitea","versions":[{"version":"1.19.0","lessThan":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-18T13:33:30.814752Z","id":"CVE-2026-73800","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38886","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38897","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-r9ch-mqjm-g67v","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-73802","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:24.670","lastModified":"2026-10-18T14:16:55.830","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to run jobs on an affected Docker-backed runner can use these options to access host namespaces and execute commands as root on the runner host, bypassing the intended container isolation."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea Runner","defaultStatus":"unaffected","packageName":"gitea.com/gitea/runner","versions":[{"version":"0","lessThan":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-18T13:34:45.738812Z","id":"CVE-2026-73802","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://blog.gitea.com/release-of-runner-3.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://gitea.com/gitea/runner/releases/tag/v3.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-73804","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:24.777","lastModified":"2026-10-18T14:16:55.970","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.26.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-18T13:40:42.994142Z","id":"CVE-2026-73804","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38862","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38895","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-q55v-4cmj-xh65","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-73814","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:24.910","lastModified":"2026-10-18T14:16:56.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-18T13:41:14.726370Z","id":"CVE-2026-73814","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38894","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38895","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-h62v-wmrr-5qjq","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-78231","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:25.533","lastModified":"2026-10-18T14:16:56.357","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services reachable from the Gitea server. The response is not returned to the attacker, so the issue is blind SSRF; its impact depends on the services and network addresses the server can reach."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"code.gitea.io/gitea","versions":[{"version":"0","lessThanOrEqual":"1.26.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-18T13:42:45.487009Z","id":"CVE-2026-78231","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8vmh-w35x-73qr","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-78433","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-14T15:17:25.637","lastModified":"2026-10-18T14:16:56.500","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"1.26.0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-18T13:35:32.390912Z","id":"CVE-2026-78433","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-863"},{"lang":"en","value":"CWE-1220"}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.3/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39048","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39077","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-frpv-2xgv-wxpq","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-104627","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-18T19:16:32.463","lastModified":"2026-10-19T21:17:03.083","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-19T20:20:04.646263Z","id":"CVE-2026-104627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.2.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39642","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39744","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mf69-7pqq-86vx","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-105964","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-18T19:16:32.700","lastModified":"2026-10-19T21:17:04.323","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"1.22.0","lessThanOrEqual":"28.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-19T20:15:11.635043Z","id":"CVE-2026-105964","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.2.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39818","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39822","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5ph","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-107686","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-18T19:16:32.903","lastModified":"2026-10-19T21:17:04.633","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-19T20:15:54.397604Z","id":"CVE-2026-107686","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"references":[{"url":"https://blog.gitea.com/release-of-28.2.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39839","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39847","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-wx44-9m3m-rjqx","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-109553","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-18T19:16:32.997","lastModified":"2026-10-19T21:17:04.780","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-19T20:19:01.147709Z","id":"CVE-2026-109553","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"references":[{"url":"https://blog.gitea.com/release-of-28.2.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39839","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39847","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-vcp6-2qc6-gvq3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-110324","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-18T19:16:33.297","lastModified":"2026-10-19T21:17:05.800","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"1.22.0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-19T20:17:29.403934Z","id":"CVE-2026-110324","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.2.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-xmfc-hqq8-33wh","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-97859","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-18T19:16:33.637","lastModified":"2026-10-19T20:52:16.127","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target user. An authenticated user could therefore read the followers, following list, starred and watched repositories and public SSH and GPG keys of a user with limited or private visibility, whom they could not otherwise see. The issue was fixed in 1.27.3 and 28.0.0 and disclosed with 28.2.0."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-19T18:54:24.078740Z","id":"CVE-2026-97859","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.2.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39004","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39039","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-xvfh-qwmh-f92w","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}}]}