CVE-2026-58442

Repository migration SSRF via multi-answer DNS allow-list bypass

Repository migration SSRF via multi-answer DNS allow-list bypass

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-58441

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-58433

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-58432

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-56443

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-58314

Two SSRF findings in Gitea 1.26.2

Two SSRF findings in Gitea 1.26.2

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-58434

Private Repository Metadata Remains Accessible After Access Revocation

Private Repository Metadata Remains Accessible After Access Revocation

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-50105

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-54481

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-55982

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-55984

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-58429

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-55986

Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-24059

Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-23603

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-34966

Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea

CVE-2026-58416

Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-56657

Gitea SSH Key Parser Denial of Service

Gitea SSH Key Parser Denial of Service

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-58510

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server