DeutschShown in its original language — a full translation is planned for a future version.
Gitea: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode
view advisory published 2026-08-30
Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder Denial-of-Service-Zustände zu verursachen.
01
describes (26)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-78433US | —OT elevated | — | ||
Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the… | ||||
| CVE-2026-73273US | — | — | ||
Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can… | ||||
| CVE-2026-73135US | — | — | ||
Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. T… | ||||
| CVE-2026-73130US | — | — | ||
Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedl… | ||||
| CVE-2026-73126US | —OT elevated | — | ||
Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:r… | ||||
| CVE-2026-71301US | — | — | ||
Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a pri… | ||||
| CVE-2026-71184US | —OT elevated | — | ||
Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from… | ||||
| CVE-2026-70407US | — | — | ||
Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible… | ||||
| CVE-2026-70406US | —OT elevated | — | ||
Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or… | ||||
| CVE-2026-70402US | — | — | ||
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another… | ||||
| CVE-2026-70400US | —OT elevated | — | ||
Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resou… | ||||
| CVE-2026-70396US | —OT elevated | — | ||
Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access… | ||||
| CVE-2026-68964US | — | — | ||
Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, finge… | ||||
| CVE-2026-68957US | — | — | ||
Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and… | ||||
| CVE-2026-67577US | — | — | ||
Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user ca… | ||||
| CVE-2026-66877US | — | — | ||
Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run shar… | ||||
| CVE-2026-66874US | —OT elevated | — | ||
For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A… | ||||
| CVE-2026-66853US | —OT elevated | — | ||
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the singl… | ||||
| CVE-2026-66849US | — | — | ||
Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate… | ||||
| CVE-2026-63792US | — | — | ||
Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a privat… | ||||
showing 20 of 26
02
references
External citations — patches, advisories, analysis.
- Gitea Release Notes vom 2026-08-30external
- GitHub Security Advisory GHSA-2xph-7j4g-43rg vom 2026-08-30external
- GitHub Security Advisory GHSA-36q5-5423-vgx2 vom 2026-08-30external
- GitHub Security Advisory GHSA-46px-6cqx-c5fv vom 2026-08-30external
- GitHub Security Advisory GHSA-5952-x23q-p23f vom 2026-08-30external
- GitHub Security Advisory GHSA-5w72-2mqm-qh46 vom 2026-08-30external
- GitHub Security Advisory GHSA-5xcq-p92v-43rf vom 2026-08-30external
- GitHub Security Advisory GHSA-5xp7-r6cr-39ff vom 2026-08-30external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan