DeutschShown in its original language — a full translation is planned for a future version.
Gitea: Mehrere Schwachstellen
view advisory published 2026-06-21
Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um erweiterte Berechtigungen zu erlangen, sich als Benutzer auszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-28740US | —OT elevated | — | ||
Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access. | ||||
| CVE-2026-27775US | —OT elevated | — | ||
Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for oth… | ||||
| CVE-2026-27761US | —OT elevated | — | ||
Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens wi… | ||||
| CVE-2026-25038US | —OT elevated | — | ||
Gitea 1.26.2 allows unauthorized users to access labels of private organizations. | ||||
| CVE-2026-24451US | — | — | ||
Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized. | ||||
| CVE-2026-22874US | — | Exploit | ||
Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering. | ||||
| CVE-2026-20896US | — | Exploit | ||
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authenticatio… | ||||
| CVE-2026-20779US | —OT elevated | — | ||
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication f… | ||||
02
references
External citations — patches, advisories, analysis.
- Gitea Release Notes vom 2026-06-21external
- GitHub Security Advisory GHSA-2m9v-5q2g-58vq vom 2026-06-21external
- GitHub Security Advisory GHSA-2r5c-gw76-rh3w vom 2026-06-21external
- GitHub Security Advisory GHSA-3pww-vcvm-3gmj vom 2026-06-21external
- GitHub Security Advisory GHSA-649p-mmhf-85c7 vom 2026-06-21external
- GitHub Security Advisory GHSA-f75j-4cw6-rmx4 vom 2026-06-21external
- GitHub Security Advisory GHSA-gx3v-q759-g323 vom 2026-06-21external
- GitHub Security Advisory GHSA-rjvx-x5h2-6px5 vom 2026-06-21external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan