DeutschShown in its original language — a full translation is planned for a future version.
Gitea: Mehrere Schwachstellen
view advisory published 2026-01-22
Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-20912US | — | — | ||
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release… | ||||
| CVE-2026-20904US | — | — | ||
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identitie… | ||||
| CVE-2026-20897US | — | — | ||
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other rep… | ||||
| CVE-2026-20888US | —OT elevated | — | ||
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges… | ||||
| CVE-2026-20883US | — | — | ||
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository… | ||||
| CVE-2026-20800US | — | — | ||
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may… | ||||
| CVE-2026-20750US | — | — | ||
Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging… | ||||
| CVE-2026-20736US | — | — | ||
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing acce… | ||||
| CVE-2026-0798US | — | — | ||
Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previousl… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan