Go Package Vulnerabilities
Vulnerabilities associated with code.gitea.io/gitea.
Packages
Clear package- github.com/mattermost/mattermost/server/v8199 vulnerabilities
- github.com/mattermost/mattermost-server178 vulnerabilities
- code.gitea.io/gitea94 vulnerabilities
- gogs.io/gogs76 vulnerabilities
- github.com/usememos/memos74 vulnerabilities
- github.com/grafana/grafana61 vulnerabilities
- github.com/rancher/rancher61 vulnerabilities
- github.com/siyuan-note/siyuan/kernel58 vulnerabilities
- github.com/hashicorp/vault55 vulnerabilities
- github.com/traefik/traefik/v253 vulnerabilities
- github.com/traefik/traefik/v352 vulnerabilities
- github.com/mattermost/mattermost-server/v647 vulnerabilities
- github.com/filebrowser/filebrowser/v243 vulnerabilities
- k8s.io/kubernetes43 vulnerabilities
- github.com/zitadel/zitadel41 vulnerabilities
- github.com/argoproj/argo-cd/v237 vulnerabilities
- github.com/cilium/cilium37 vulnerabilities
- github.com/docker/docker36 vulnerabilities
- github.com/answerdev/answer34 vulnerabilities
- github.com/argoproj/argo-cd34 vulnerabilities
- github.com/hashicorp/nomad34 vulnerabilities
- code.vikunja.io/api33 vulnerabilities
- github.com/hashicorp/consul32 vulnerabilities
- github.com/openbao/openbao29 vulnerabilities
- github.com/traefik/traefik29 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-24791HIGH | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routesPublic-only tokens bypass private-resource restrictions on `/api/v1/user` self routes CWE-863Aug 13, 2026 | CVSS8.1v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud MetadataSSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata CWE-918Aug 13, 2026 | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploadsUnbounded Arch package file metadata can cause resource amplification in Gitea package uploads | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Webhook Authorization Header Returned in Plaintext via APIWebhook Authorization Header Returned in Plaintext via API CWE-200Aug 13, 2026 | CVSS2.7v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-58510MEDIUM | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->privateGHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private | CVSS4.3v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Private Repository Existence Disclosure via go-get Meta EndpointPrivate Repository Existence Disclosure via go-get Meta Endpoint | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APICross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contentsPersonal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents CWE-863Aug 13, 2026 | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Public-only repository tokens can update private PR head branchesPublic-only repository tokens can update private PR head branches CWE-863Aug 13, 2026 | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Repository migration SSRF via multi-answer DNS allow-list bypassRepository migration SSRF via multi-answer DNS allow-list bypass | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURLSSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL CWE-918Aug 13, 2026 | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval FlagBranch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Repository Visibility Manipulation via Git Push OptionsRepository Visibility Manipulation via Git Push Options CWE-284Aug 13, 2026 | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Gitea LFS Deploy-Key Privilege EscalationGitea LFS Deploy-Key Privilege Escalation | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Private Repository Metadata Remains Accessible After Access RevocationPrivate Repository Metadata Remains Accessible After Access Revocation | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/giteaMissing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Public-Only Personal access tokens scope bypass in Organization and Permission EndpointsPublic-Only Personal access tokens scope bypass in Organization and Permission Endpoints | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Two SSRF findings in Gitea 1.26.2Two SSRF findings in Gitea 1.26.2 CWE-918Aug 13, 2026 | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-57897MEDIUM | Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIsCross-Repo Information Disclosure via Org-Level Actions Run/Job APIs | CVSS6.5v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository ExfiltrationRepository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration CWE-918Aug 13, 2026 | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Cross-repository issue/comment attachment re-linking can expose private attachment contentCross-repository issue/comment attachment re-linking can expose private attachment content | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package UploadDenial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |