Vulnerabilities in Gitea
210 resultsCVE-2025-68940LOWIn Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.EPSS 0.3%CVE-2026-119627MEDIUMGitea limited-visibility profile disclosure with public-only tokensEPSS 0.3%CVE-2026-0798LOWGitea Release Email Notifications Leak Private Repository Release Details After Access RevocationEPSS 0.3%CVE-2026-89430HIGHGitea push mirror SSRF and forced writes to internal Git hostsEPSS 0.3%CVE-2026-117635MEDIUMGitea admin API public-only token scope bypassEPSS 0.3%CVE-2026-66874MEDIUMGitea required Actions check bypass through skipped workflowsEPSS 0.3%CVE-2026-97208MEDIUMGitea push mirror API bypass of DISABLE_NEW_PUSH policyEPSS 0.3%CVE-2025-68941MEDIUMGitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.EPSS 0.3%CVE-2026-110324MEDIUMGitea private profile information disclosure through POST requestEPSS 0.3%CVE-2026-117649LOWGitea private issue disclosure through issue dependency timeline eventsEPSS 0.3%CVE-2026-103504HIGHGitea API team demotion not applied to unit permissionsEPSS 0.3%CVE-2026-78231MEDIUMGitea blind SSRF through OpenID assertion verificationEPSS 0.3%CVE-2026-104636HIGHGitea SSRF through Git HTTP redirects in mirrors and fetchesEPSS 0.3%CVE-2026-119441HIGHGitea public-only token bypass on bulk organization repository deletionEPSS 0.3%CVE-2026-58424HIGHPermanent Fork PR Workflow Approval Gate BypassEPSS 0.3%CVE-2025-68942MEDIUMGitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.EPSS 0.2%CVE-2025-68946MEDIUMIn Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.EPSS 0.2%CVE-2026-96589MEDIUMGitea private repository access retained after rejected transferEPSS 0.2%CVE-2026-119625MEDIUMGitea user and organization feed token scope bypassEPSS 0.2%CVE-2026-114199MEDIUMGitea contribution heatmap private activity disclosure to public-only tokensEPSS 0.2%