Vulnerabilidades em Gitea
210 resultadosAnálise Vexday
Gitea apresenta perfil de risco moderado com 63 vulnerabilidades catalogadas, sendo 16 críticas (CVSS≥9) e 41 publicadas nos últimos 90 dias, indicando exposição a descobertas recentes. Apesar da ausência de exploração ativa registrada (KEV=0), a fraqueza dominante CWE-284 (controle de acesso inadequado) representa vetor de risco estrutural que demanda revisão de permissões e segmentação. A velocidade de publicação de vulnerabilidades sugere monitoramento contínuo de patches.
CVE-2026-56750CRITICALGitea Remember-Me Token Theft Not Invalidating Attacker SessionEPSS 0.5%CVE-2026-73804HIGHGitea API token scope escalation through HTTP signaturesEPSS 0.5%CVE-2026-73539HIGHGitea external renderer argument injection and code executionEPSS 0.5%CVE-2026-58429MEDIUMPublic-Only Personal access tokens scope bypass in Organization and Permission EndpointsEPSS 0.5%CVE-2026-60010MEDIUMGitea organization team policy bypass through repository APIEPSS 0.5%CVE-2026-58420MEDIUMLocal File Inclusion via file:// URI in Migration RestoreEPSS 0.5%CVE-2026-73814MEDIUMGitea repository ownership escalation by administratorsEPSS 0.5%CVE-2026-58417HIGHREST API exposes organization membership of private organizations to publicEPSS 0.5%CVE-2026-58427HIGHPrivate org member list leaked via /members API endpoint — incomplete fix for PR #38145EPSS 0.5%CVE-2026-58438HIGHCross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot accessEPSS 0.5%CVE-2026-73278CRITICALGitea WebAuthn bypass during OAuth and OIDC sign-inEPSS 0.5%CVE-2026-58434HIGHPrivate Repository Metadata Remains Accessible After Access RevocationEPSS 0.5%CVE-2026-22874CRITICALGitea webhook and migration allow-list filtering permits SSRFEPSS 0.5%CVE-2026-58428MEDIUMRelease attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)EPSS 0.5%CVE-2026-55984LOWNull Pointer Dereference in AddTime API Causes Authenticated Denial of ServiceEPSS 0.5%CVE-2026-20897CRITICALGitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)EPSS 0.5%CVE-2026-20912CRITICALGitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment DisclosureEPSS 0.5%CVE-2026-28705MEDIUMGitea repository dumps write release assets using unsafe path namesEPSS 0.5%CVE-2026-27657HIGHGitea email settings allow changing another user's primary email addressEPSS 0.5%CVE-2026-27761MEDIUMGitea repository feeds bypass API token scope enforcementEPSS 0.5%