WID-SEC-W-2026-2149

DeutschShown in its original language — a full translation is planned for a future version.

Gitea: Mehrere Schwachstellen

view advisory published 2026-06-30

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

describes (7)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-58426US	—	0.23% (14th)	—	2026-07-03
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
CVE-2026-58424US	—OT elevated	0.25% (17th)	Exploit	2026-07-03
Permanent Fork PR Workflow Approval Gate Bypass
CVE-2026-58423US	—	0.39% (33rd)	—	2026-07-03
LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
CVE-2026-58422US	—	0.43% (37th)	—	2026-07-03
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
CVE-2026-58421US	—	0.40% (34th)	—	2026-07-03
Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
CVE-2026-58419US	—	0.38% (32nd)	—	2026-07-03
Notification API leaks private issue metadata after access revocation
CVE-2026-58418US	—	0.31% (24th)	—	2026-07-03
SSRF via HTTP Redirect in Repository Migration

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan