DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Gitea: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-01-22
Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (9)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-20912US | — | — | ||
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release… | ||||
| CVE-2026-20904US | — | — | ||
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identitie… | ||||
| CVE-2026-20897US | — | — | ||
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other rep… | ||||
| CVE-2026-20888US | —OT erhöht | — | ||
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges… | ||||
| CVE-2026-20883US | — | — | ||
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository… | ||||
| CVE-2026-20800US | — | — | ||
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may… | ||||
| CVE-2026-20750US | — | — | ||
Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging… | ||||
| CVE-2026-20736US | — | — | ||
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing acce… | ||||
| CVE-2026-0798US | — | — | ||
Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previousl… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan