github.com/go-gitea/gitea vulnerabilities

20 known advisories · Dependencies not checked

SEVERITYADVISORYPUBLISHED

CriticalImproper Access Control in GiteaGHSA-r7h7-chh4-5rvmBIT-gitea-2020-28991CVE-2020-28991Affected >=0.9.99 <1.12.6Fixed in 1.12.6OSV source ↗3 years ago

CriticalGitea vulnerable to Argument InjectionGHSA-w8xw-7crf-h23xBIT-gitea-2022-42968CVE-2022-42968GO-2022-1065Affected <1.17.3Fixed in 1.17.3OSV source ↗4 years ago

CriticalCapture-replay in GiteaGHSA-jrpg-35hw-m4p9BIT-gitea-2021-45327CVE-2021-45327GO-2022-0310Affected <1.11.2Fixed in 1.11.2OSV source ↗5 years ago

HighCross Site Request Forgery in GiteaGHSA-4wp3-8q92-mh8wBIT-gitea-2021-45326CVE-2021-45326GO-2022-0309Affected <1.5.2Fixed in 1.5.2OSV source ↗5 years ago

HighGitea Remote Code ExecutionGHSA-hpmr-prr2-cqc4CVE-2019-11229GO-2022-0846Affected <1.7.6Fixed in 1.7.6OSV source ↗5 years ago

HighGitea Improper Input ValidationGHSA-q47x-6mqq-4w92CVE-2019-11228GO-2022-0862Affected <1.7.6Fixed in 1.7.6OSV source ↗5 years ago

HighDenial of Service in GiteaGHSA-g2qx-6ghw-67hmBIT-gitea-2020-13246CVE-2020-13246GO-2022-0830Affected <1.12.0Fixed in 1.12.0OSV source ↗5 years ago

HighBuffer Overflow in giteaGHSA-9f8c-pfvv-p4gmBIT-gitea-2021-3382CVE-2021-3382GO-2024-2757Affected >=1.9.0 <1.13.2Fixed in 1.13.2OSV source ↗3 years ago

MediumCross-site Scripting in GiteaGHSA-r3gq-wxqf-q4ghBIT-gitea-2021-45329CVE-2021-45329GO-2022-0314Affected <1.5.1Fixed in 1.5.1OSV source ↗5 years ago

MediumOpen redirect in GiteaGHSA-36h2-95gj-w488BIT-gitea-2021-45328CVE-2021-45328GO-2022-0579Affected <1.4.3Fixed in 1.4.3OSV source ↗5 years ago

MediumGitea: Open Redirect via redirect_toGHSA-j5r2-4c8j-xc3mCVE-2026-25779GO-2026-5448Affected <1.26.0Fixed in 1.26.0OSV source ↗5 months ago

MediumGitea does not properly validate repository ownership when linking attachments to releasesGHSA-4xx9-vc8v-87hvBIT-gitea-2026-20912CVE-2026-20912GHSA-vfmv-f93v-37mwGO-2026-4364Affected <1.25.4Fixed in 1.25.4OSV source ↗10 months ago

MediumGitea does not properly validate ownership when toggling OpenID URI visibilityGHSA-qqgv-v353-cv8pBIT-gitea-2026-20904CVE-2026-20904GHSA-jrpc-w85r-hgqxGO-2026-4369Affected <1.25.4Fixed in 1.25.4OSV source ↗10 months ago

MediumGitea does not properly validate repository ownership when deleting Git LFS locksGHSA-393c-qgvj-3xphBIT-gitea-2026-20897CVE-2026-20897GHSA-rrq5-r9h5-pc7cGO-2026-4363Affected <1.25.4Fixed in 1.25.4OSV source ↗10 months ago

MediumGitea does not properly verify authorization when canceling scheduled auto-merges via the web interfaceGHSA-9cgq-wp42-4rpqBIT-gitea-2026-20888CVE-2026-20888GHSA-ccq9-c5hv-cf64GO-2026-4366Affected <1.25.4Fixed in 1.25.4OSV source ↗10 months ago

MediumGitea does not properly validate project ownership in organization project operationsGHSA-rw22-5hhq-pfpfBIT-gitea-2026-20750CVE-2026-20750GHSA-h4fh-pc4w-8w27GO-2026-4370Affected <1.25.4Fixed in 1.25.4OSV source ↗10 months ago

MediumGitea Exposes Private Email AddressesGHSA-f5fj-7265-jxhjCVE-2018-1000803GO-2022-0823Affected <1.5.1Fixed in 1.5.1OSV source ↗5 years ago

MediumGitea displaying raw OpenID error in UIGHSA-8h8p-x289-vvqrBIT-gitea-2021-45325CVE-2021-45325GO-2022-0308Affected <1.7.0Fixed in 1.7.0OSV source ↗5 years ago

LowGitea improperly exposes issue and pull request titlesGHSA-2vgv-hgv4-22mhBIT-gitea-2026-20800CVE-2026-20800GHSA-g54m-9f6g-wj7qGO-2026-4362Affected <1.25.4Fixed in 1.25.4OSV source ↗10 months ago

LowGitea improperly exposes issue titles and repository names through previously started stopwatchesGHSA-j8xr-c56q-m8jjBIT-gitea-2026-20883CVE-2026-20883GHSA-644v-xv3j-xgqgGO-2026-4368Affected <1.25.4Fixed in 1.25.4OSV source ↗10 months ago