---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: < 1.27.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea is vulnerable to server-side request forgery (SSRF) due to improper validation of URLs in migration asset downloads, allowing access to internal files and cloud metadata.

Executive Summary:
A critical SSRF vulnerability in Gitea allows unauthenticated attackers to read internal files and cloud metadata by bypassing host filtering mechanisms.

Vulnerability Details

CVE-ID: CVE-2026-59765

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: < 1.27.0

Vulnerability: The application fails to adequately sanitize migration and webhook URLs (CWE-918). While some functions use a hardened dialer, others utilize the Go DefaultClient, which bypasses host matching protections and allows requests to the local file system via the file scheme.

Business Impact

The CVSS score of 7.5 reflects the high risk of unauthorized information disclosure. An attacker can leverage this flaw to access sensitive cloud metadata, environment variables, or internal configuration files, which could lead to full system compromise or lateral movement within the network.

Remediation Plan

Immediate Action: Update Gitea Open Source Git Server to version 1.27.0 or later immediately.

Proactive Monitoring: Inspect server logs for outbound requests to internal IP addresses or unusual file access patterns originating from the Gitea service account.

Compensating Controls: Restrict Gitea's ability to initiate outbound network connections to internal resources using network-level access control lists (ACLs) or egress filtering.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as identified per CISA's SSVC assessment.

Analyst Notes: As of August 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the bypass of existing security controls.

Analyst Recommendation

Given the availability of a proof-of-concept and the potential for severe data leakage, upgrading to version 1.27.0 is mandatory. Organizations should treat this as a high-priority update to prevent potential exfiltration of sensitive cloud credentials.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An HMAC ambiguity in Gitea Actions Artifacts allows cross-repository data reads and cross-task state writes, compromising the integrity and confidentiality of CI/CD pipelines.

Executive Summary:
A critical vulnerability in Gitea Actions allows attackers to bypass repository boundaries, resulting in unauthorized access to sensitive artifacts and the ability to manipulate CI/CD task states.

Vulnerability Details

CVE-ID: CVE-2026-58426

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: See vendor advisory

Vulnerability: The vulnerability involves an HMAC ambiguity in the V4 signed URLs for Actions Artifacts, which can be exploited by an authenticated user to perform unauthorized read operations across repositories and write operations across tasks.

Business Impact

Exploitation of this flaw undermines the security of the entire CI/CD environment. Attackers could steal proprietary source code or build secrets, or inject malicious code into build processes by manipulating task states. The CVSS score of 9.6 highlights the extreme risk to the software supply chain and organizational development integrity.

Remediation Plan

Immediate Action: Update the Gitea instance to the latest version as specified in the vendor's security advisory to address the HMAC validation logic.

Proactive Monitoring: Review CI/CD pipeline logs for unauthorized artifact access or unexpected changes to task statuses.

Compensating Controls: Implement strict repository-level access controls and minimize the use of shared runners where possible to reduce the blast radius of potential exploits.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for supply chain compromise, organizations utilizing Gitea Actions must prioritize this patch. Security teams should work closely with DevOps engineers to ensure the update is validated in a non-production environment before full deployment to critical CI/CD infrastructure.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Gitea workflow approval mechanism allows users to bypass the designated approval gate for permanent fork pull requests.

Executive Summary:
A workflow approval bypass vulnerability in Gitea Open Source Git Server compromises the integrity of the code review process by allowing unauthorized pull request merges.

Vulnerability Details

CVE-ID: CVE-2026-58424

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a logic flaw in the permanent fork PR workflow, which fails to properly enforce approval gates. This allows authenticated users with sufficient repository access to bypass mandatory review processes and merge code changes without authorization.

Business Impact

Exploitation of this flaw undermines the secure software development lifecycle (SDLC) by enabling the injection of unverified or malicious code into protected branches. With a CVSS score of 8.9, this vulnerability poses a high risk to code integrity, which could be leveraged to introduce backdoors or supply chain vulnerabilities into the production environment.

Remediation Plan

Immediate Action: Apply the vendor-provided security update immediately upon release to restore integrity to the pull request approval gates.

Proactive Monitoring: Audit recent pull request activity and merge history to identify any code changes that were merged without the required approvals.

Compensating Controls: Enforce manual code reviews via external process or implement branch protection rules that require administrative intervention for critical merges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant breakdown in repository governance. Organizations should treat this as a high-priority issue and ensure that all development workflows are re-validated once the patch is applied to ensure no unauthorized code was introduced during the vulnerable window.

---METADATA---
VENDOR: Gitea
PRODUCT: Open Source Git Server
AFFECTED_VERSIONS: Gitea Gitea Open Source Git Server: 0 through 1.26.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper authorization flaw in the OAuth sign-in callback mechanism allows attackers to silently re-enable previously disabled administrator accounts.

Executive Summary:
A critical authorization bypass in Gitea Open Source Git Server allows attackers to regain access to disabled accounts, posing a severe risk of unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2026-58422

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea Gitea Open Source Git Server: 0 through 1.26.1

Vulnerability: This vulnerability involves improper authorization handling during the OAuth sign-in callback process. An attacker can exploit this to silently re-enable accounts that have been explicitly disabled by administrators, effectively bypassing account lockout security policies.

Business Impact

With a CVSS score of 9.8 (Critical), this vulnerability represents a severe threat to the integrity and confidentiality of the environment. Successful exploitation allows unauthorized access to potentially privileged accounts, leading to full system compromise, data theft, and loss of control over the Git infrastructure.

Remediation Plan

Immediate Action: Update Gitea to version 1.26.2 or later to address the flaw in the OAuth callback authentication logic.

Proactive Monitoring: Review audit logs for unexpected account reactivations or suspicious OAuth sign-in events, particularly for accounts that were previously marked as disabled.

Compensating Controls: Temporarily disable OAuth provider integration if patching cannot be performed immediately, forcing users to authenticate via standard local credentials.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jul 3, 2026, proof-of-concept exploits are available. The ability to bypass administrative account controls makes this an urgent priority for all Gitea administrators.

Analyst Recommendation

This is a critical security issue that requires immediate attention. Security teams must ensure all instances are updated to the latest version to prevent unauthorized account access and potential privilege escalation.

---METADATA---
VENDOR: Gitea
PRODUCT: Open Source Git Server
AFFECTED_VERSIONS: Gitea Gitea Open Source Git Server: 0 up to (excluding) 1.26.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated Regular Expression Denial of Service (ReDoS) vulnerability exists in Gitea's CODEOWNERS pattern matching, allowing attackers to cause excessive resource consumption.

Executive Summary:
An unauthenticated ReDoS vulnerability in Gitea Open Source Git Server allows remote attackers to trigger a denial of service via crafted CODEOWNERS patterns.

Vulnerability Details

CVE-ID: CVE-2026-58421

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea Gitea Open Source Git Server: 0 up to (excluding) 1.26.2

Vulnerability: This is an unauthenticated ReDoS vulnerability affecting the CODEOWNERS pattern matching functionality. By submitting specially crafted patterns, an attacker can exhaust system resources, leading to a denial of service.

Business Impact

The CVSS score of 7.5 (High) reflects the potential for significant service disruption. While the vulnerability does not lead to data exfiltration or unauthorized modification, the resulting denial of service can render the Git infrastructure unavailable to developers, stalling CI/CD pipelines and software delivery processes.

Remediation Plan

Immediate Action: Upgrade all Gitea instances to version 1.26.2 or later to apply the necessary patches for pattern matching logic.

Proactive Monitoring: Monitor server CPU and memory utilization patterns for sudden spikes that may indicate attempts to trigger ReDoS conditions.

Compensating Controls: Implement WAF rules to sanitize or block malformed inputs in requests targeting repository configuration files or CODEOWNERS patterns.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jul 3, 2026, proof-of-concept exploits are available for this vulnerability. Given the ease of exploitation, immediate patching is recommended to prevent service degradation.

Analyst Recommendation

The availability of proof-of-concept exploits significantly elevates the risk of this vulnerability being leveraged by malicious actors. Organizations should prioritize updating their Gitea installations to version 1.26.2 immediately to neutralize the threat.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in Gitea Open Source Git Server has been identified that may facilitate unauthorized system interaction.

Executive Summary:
Gitea Open Source Git Server is susceptible to a high-severity flaw that may allow attackers to compromise the integrity of the application environment.

Vulnerability Details

CVE-ID: CVE-2026-28744

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability impacts Gitea versions up to and including 1. The flaw requires immediate attention to prevent potential exploitation of the application's underlying architecture.

Business Impact

With a CVSS score of 8.1, this vulnerability is categorized as high risk. Successful exploitation could lead to unauthorized access to sensitive source code repositories and potential operational downtime, significantly threatening the security posture of the development infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-supplied security updates immediately upon availability to eliminate the underlying vulnerability.

Proactive Monitoring: Monitor application logs for anomalous traffic patterns or unauthorized attempts to perform administrative actions within the Gitea instance.

Compensating Controls: Deploy WAF rules designed to filter malicious requests directed at the Gitea server, providing a temporary layer of protection while updates are being staged for deployment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The urgency of this vulnerability is significant due to its high severity rating. Organizations should maintain a proactive stance by monitoring vendor security channels and applying the necessary updates immediately upon release to mitigate exposure to potential attackers.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Versions before 1.26.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Gitea versions before 1.26.0 fail to handle errors correctly during pre-receive hook processing, allowing attackers to bypass branch-protection checks using oversized input.

Executive Summary:
An authorization bypass vulnerability in Gitea versions prior to 1.26.0 allows attackers to circumvent critical branch-protection security controls.

Vulnerability Details

CVE-ID: CVE-2026-27780

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: Versions before 1.26.0

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) resulting from a failure to close connections or halt processes when a bufio.Scanner error occurs. By providing specifically crafted, oversized input during the pre-receive hook process, an attacker can cause the system to ignore security checks, effectively bypassing branch protections.

Business Impact

The ability to bypass branch protections with a CVSS score of 9.8 poses a catastrophic risk to the integrity of the software development lifecycle. Unauthorized code changes can be pushed to protected branches, potentially allowing the introduction of malicious backdoors or unauthorized modifications to production-critical source code.

Remediation Plan

Immediate Action: Upgrade to Gitea version 1.26.0 or higher to ensure proper input validation and error handling for pre-receive hooks.

Proactive Monitoring: Review repository push logs for abnormal activity or attempts to push to protected branches that should have been rejected.

Compensating Controls: Implement strict CI/CD pipeline checks that verify code integrity independently of the Git server's native branch protection mechanisms.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, the criticality of the bypass necessitates immediate attention.

Analyst Recommendation

This vulnerability is critical due to the potential for total compromise of repository integrity. Administrators must upgrade to version 1.26.0 or later immediately to restore the effectiveness of branch-protection policies and prevent unauthorized code modifications.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: 0 up to (excluding) 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea versions before 1.25.5 are vulnerable to canonical URL spoofing due to improper validation of forwarded-proto headers.

Executive Summary:
A vulnerability in Gitea allows attackers to spoof canonical URLs by injecting malformed forwarded-proto headers, potentially leading to unauthorized redirection or phishing risks.

Vulnerability Details

CVE-ID: CVE-2026-27779

Affected Software: Gitea Open Source Git Server

Affected Versions: 0 up to (excluding) 1.25.5

Vulnerability: The application incorrectly handles forwarded-proto values when detecting the public URL of the server. An unauthenticated attacker can manipulate these headers to influence how the server generates canonical URLs, which could be used to redirect users to malicious sites or poison cache/link generation.

Business Impact

While the CVSS score is 7.5, the primary risk involves the integrity of links generated by the server. An attacker could trick users into clicking malicious links that appear to originate from the legitimate Gitea instance, potentially leading to credential harvesting or the distribution of malicious content, damaging organizational trust.

Remediation Plan

Immediate Action: Update the Gitea instance to version 1.25.5 or later.

Proactive Monitoring: Monitor access logs for anomalous requests containing unexpected or malformed headers, particularly those targeting URL generation or proxy-related headers.

Compensating Controls: Configure your reverse proxy (e.g., Nginx, HAProxy) to strip or sanitize X-Forwarded-Proto headers to ensure only trusted values are passed to the Gitea backend.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is considered automatable, increasing the risk of widespread scanning for vulnerable instances.

Analyst Recommendation

Organizations hosting Gitea should prioritize the update to version 1.25.5 to prevent potential URL spoofing attacks. In addition to patching, ensuring that the reverse proxy is correctly configured to sanitize incoming headers provides a necessary layer of defense-in-depth against header injection attacks.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A cache misconfiguration in Gitea 1.25.5 allows authenticated users to escalate privileges by reusing branch-specific write permissions across unauthorized repository references.

Executive Summary:
A privilege escalation vulnerability in Gitea 1.25.5 could allow an authenticated user to gain unauthorized full write access to a repository.

Vulnerability Details

CVE-ID: CVE-2026-27775

Affected Software: Gitea Open Source Git Server

Affected Versions: 1.25.5

Vulnerability: This is an improper authorization flaw (CWE-863) where the application incorrectly caches write-permission results during a pre-receive hook session, allowing authenticated users with limited scope to bypass access controls.

Business Impact

Successful exploitation allows a low-privileged user to modify code, inject malicious commits, or disrupt project integrity, leading to potential supply chain compromise. With a CVSS score of 8.8, this high-severity flaw poses a significant risk to development environments, as it undermines the fundamental access control mechanisms protecting source code repositories.

Remediation Plan

Immediate Action: Upgrade Gitea to version 1.26.3 or later to apply the necessary security patches.

Proactive Monitoring: Review repository access logs for unusual commit activity or unauthorized modifications made by users outside of their assigned branches.

Compensating Controls: Implement strict branch protection rules and enforce mandatory code reviews for all incoming changes to limit the impact of potential unauthorized writes.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is rooted in session-level caching logic, making it a targeted vector for sophisticated actors.

Analyst Recommendation

Given the critical nature of repository integrity, organizations utilizing Gitea must prioritize this update immediately. Failure to patch allows authenticated users to potentially gain unauthorized control over the entire codebase, necessitating an urgent deployment of the available fix.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: 0 up to (excluding) 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea versions prior to 1.25.5 contain an authorization flaw that permits unauthorized access to draft release data and attachments.

Executive Summary:
An authorization vulnerability in Gitea allows unauthenticated or unauthorized users to access sensitive draft release content and attachments.

Vulnerability Details

CVE-ID: CVE-2026-27660

Affected Software: Gitea Open Source Git Server

Affected Versions: 0 up to (excluding) 1.25.5

Vulnerability: This vulnerability (CWE-284) stems from a failure to enforce correct access control checks when retrieving draft release information, allowing actors to bypass security requirements for sensitive project data.

Business Impact

This flaw may lead to the premature exposure of proprietary software releases, documentation, or internal attachments, potentially resulting in intellectual property leakage or the exposure of sensitive security information before a product is officially launched. With a CVSS score of 7.5, the vulnerability represents a substantial risk to the confidentiality of development project lifecycles.

Remediation Plan

Immediate Action: Update Gitea to version 1.25.5 or later to resolve the underlying access control bypass.

Proactive Monitoring: Monitor access logs for unauthorized requests directed at release-related endpoints, particularly those targeting draft or unreleased content.

Compensating Controls: Restrict public network access to the Gitea instance if possible, or employ a WAF to filter requests targeting release and attachment APIs.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any user who can reach the release endpoints, regardless of their authentication status.

Analyst Recommendation

Administrators should treat this as a high-priority update to ensure that draft release information remains confidential. Immediate patching to version 1.25.5 is strongly recommended to prevent the unauthorized disclosure of sensitive project data.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: 0 up to (excluding) 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea versions before 1.25.5 fail to use the migration HTTP transport for LFS operations, bypassing configured security protections for push and sync mirror requests.

Executive Summary:
A critical security gap in Gitea Open Source Git Server allows attackers to bypass LFS transport protections, potentially leading to the interception or manipulation of sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-26292

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: 0 up to (excluding) 1.25.5

Vulnerability: The application fails to utilize the migration HTTP transport for LFS (Large File Storage) push and sync mirror operations. This bypasses established security protections, allowing unauthenticated attackers to potentially intercept or manipulate LFS data transfers through unencrypted channels or weak authentication mechanisms.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting the ability of an attacker to compromise both data integrity and confidentiality. By manipulating LFS data, an attacker could inject malicious files into repositories or exfiltrate sensitive large assets, leading to severe downstream impacts on software supply chains and organizational data security.

Remediation Plan

Immediate Action: Upgrade to Gitea version 1.25.5 or later to ensure that all LFS operations are correctly routed through the secure migration HTTP transport.

Proactive Monitoring: Review network traffic and server logs for anomalous LFS synchronization activity or unexpected outbound connections from the Git server.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect LFS-related HTTP traffic for signs of manipulation until the patch can be fully applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity of repository assets. Organizations must prioritize the upgrade to version 1.25.5 to close the transport security gap and protect LFS data from unauthorized interception or tampering.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: 0 up to (excluding) 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea versions before 1.25.5 fail to correctly persist OAuth2 PKCE S256 challenges, allowing token exchange to proceed without mandatory verifier validation.

Executive Summary:
A critical security flaw in Gitea Open Source Git Server allows attackers to bypass OAuth2 PKCE verifier checks, weakening the integrity of the authentication process.

Vulnerability Details

CVE-ID: CVE-2026-26247

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: 0 up to (excluding) 1.25.5

Vulnerability: The application fails to correctly persist the PKCE (Proof Key for Code Exchange) S256 challenge method during the authorization flow. This allows an unauthenticated attacker to complete the token exchange process without the required cryptographic verification, undermining the OAuth2 security model.

Business Impact

By bypassing PKCE verifiers, attackers can potentially intercept or spoof authorization flows, leading to unauthorized access to user accounts and repository resources. The CVSS score of 9.1 highlights the critical nature of this flaw, as it allows an attacker to subvert core authentication protections, risking the confidentiality and integrity of hosted development environments.

Remediation Plan

Immediate Action: Apply the vendor-provided patch by upgrading Gitea to version 1.25.5 or later immediately.

Proactive Monitoring: Monitor access logs for unusual OAuth2 token exchange requests that do not follow standard flow patterns.

Compensating Controls: Ensure that TLS is strictly enforced for all OAuth2 callback endpoints to minimize the window for interception while the upgrade is being deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for unauthorized access, administrators must treat this as a high-priority update. Upgrading to version 1.25.5 is the only effective way to restore the integrity of the OAuth2 authentication process and prevent potential account compromise.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Gitea versions prior to 1.26.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea is susceptible to an authorization bypass where authenticated low-privilege users can push unauthorized commits to repositories by abusing the pull request maintainer edit flag.

Executive Summary:
A critical authorization bypass vulnerability in Gitea allows authenticated low-privileged users to perform unauthorized write operations on repositories.

Vulnerability Details

CVE-ID: CVE-2026-26231

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea versions prior to 1.26.2

Vulnerability: This is an authorization bypass vulnerability affecting the "Allow edits from maintainers" feature. An authenticated user with read-only access can exploit this by using reverse-fork pull requests to push commits to an upstream repository without proper write-access validation.

Business Impact

The ability for unauthorized users to push arbitrary code to repositories poses a severe risk to software supply chain integrity. With a CVSS score of 8.5, this vulnerability could lead to the injection of malicious code, backdoors, or the corruption of production-ready source code, resulting in significant reputational damage and potential system compromise.

Remediation Plan

Immediate Action: Upgrade all Gitea instances to version 1.26.2 or later to resolve the authorization logic flaw.

Proactive Monitoring: Review repository commit logs for suspicious activity or unexpected contributions from users who do not hold write permissions.

Compensating Controls: Strictly enforce branch protection rules and require signed commits to ensure that only authorized changes are merged into critical branches.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score of 8.5, this vulnerability represents a significant risk to development environments. Organizations should prioritize the update to Gitea 1.26.2 immediately to prevent unauthorized code injection and maintain the integrity of their Git workflows.

---METADATA---
VENDOR: Gitea
PRODUCT: Open Source Git Server
AFFECTED_VERSIONS: Gitea versions before 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea versions before 1.25.5 improperly handle path resolution during template repository generation, allowing reads or writes through symlinks or non-regular paths.

Executive Summary:
A critical path traversal vulnerability in Gitea prior to 1.25.5 permits unauthorized file system access during template processing, creating a high risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-25718

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea versions before 1.25.5

Vulnerability: This is an improper link resolution vulnerability (CWE-59) occurring during template repository generation. An unauthenticated attacker can manipulate paths to read from or write to arbitrary locations on the server file system by exploiting the failure to properly validate symlinks.

Business Impact

The CVSS score of 9.1 highlights the critical nature of this vulnerability. If exploited, an attacker could potentially read sensitive configuration files, steal credentials, or overwrite critical system files to achieve remote code execution, leading to a complete compromise of the Gitea server.

Remediation Plan

Immediate Action: Upgrade to Gitea version v1.25.5 or later immediately to patch the insecure path resolution logic.

Proactive Monitoring: Review system logs for signs of unauthorized file access or unexpected file system operations. Monitor for any attempts to create or interact with symbolic links in repository directories.

Compensating Controls: Ensure the Gitea service runs with the least privilege possible to limit the scope of damage an attacker can inflict if they successfully exploit a file-system-level vulnerability.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation. The high CVSS score, however, necessitates immediate attention to prevent potential system-wide impact.

Analyst Recommendation

Due to the critical severity and the potential for remote file system manipulation, this vulnerability should be treated as a high-priority incident. Patching to v1.25.5 is the only effective way to remediate the underlying path resolution flaw.

---METADATA---
VENDOR: Gitea
PRODUCT: Open Source Git Server
AFFECTED_VERSIONS: Gitea 1.26.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea 1.26.2 contains an improper authorization vulnerability that allows unauthenticated users to access labels belonging to private organizations.

Executive Summary:
A critical authorization bypass in Gitea 1.26.2 permits unauthenticated users to access sensitive labels of private organizations, posing a risk to information confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-25038

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea 1.26.2

Vulnerability: This is an improper authorization vulnerability (CWE-862) and an information exposure flaw (CWE-200) where the application fails to perform necessary capability checks. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation allows unauthorized parties to view sensitive metadata regarding private projects, which can lead to the exposure of internal organization structures and project naming conventions, potentially aiding in further targeted attacks against the organization.

Remediation Plan

Immediate Action: Upgrade Gitea to version v1.26.3 or later immediately to resolve the authorization flaw.

Proactive Monitoring: Review web access logs for unusual patterns of requests directed at label-related endpoints, particularly those originating from unauthorized or external IP addresses.

Compensating Controls: Implement strict network access controls (ACLs) to restrict access to the Gitea instance to known, trusted IP ranges where possible to minimize exposure to external threats.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 3, 2026, public proof-of-concept exploit code exists for this vulnerability. Given the ease of exploitation, immediate patching is required.

Analyst Recommendation

The presence of a public exploit significantly elevates the risk of this vulnerability. Administrators must prioritize the upgrade to v1.26.3 to close this unauthorized access vector and prevent the leakage of sensitive organizational metadata.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Gitea versions before 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea versions before 1.25.5 contain an access control vulnerability that allows unauthorized updating or rebasing of pull request branches.

Executive Summary:
A high-severity access control vulnerability in Gitea versions before 1.25.5 permits unauthorized modification of pull request branches, threatening code integrity.

Vulnerability Details

CVE-ID: CVE-2026-24690

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea versions before 1.25.5

Vulnerability: This vulnerability (CWE-284) involves insufficient permission checks when updating or rebasing pull request branches. Attackers can leverage this flaw to modify pull requests in ways that should be restricted, potentially leading to the injection of unauthorized code changes into protected branches.

Business Impact

The CVSS score of 7.5 (High) highlights the risk to the integrity of the development process. If an attacker can manipulate pull requests, they may bypass code review processes or introduce malicious commits, leading to supply chain compromises or unauthorized code execution within the organization's projects. The ability to alter the state of pull requests directly impacts the trust and reliability of the code base.

Remediation Plan

Immediate Action: Upgrade your Gitea instance to version 1.25.5 or later to resolve the permission check deficiencies.

Proactive Monitoring: Monitor Git server logs for suspicious rebase or update activity on pull requests, particularly those originating from unauthorized users.

Compensating Controls: Enforce strict branch protection rules and require signed commits to ensure that any unauthorized changes to pull requests can be detected and reverted.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Maintaining the integrity of the source code is paramount. It is strongly recommended to update to version 1.25.5 immediately to address the insufficient access controls and prevent unauthorized modifications to pull requests, which could otherwise jeopardize the security of the entire software development lifecycle.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Up to and including 1.26.2
---END_METADATA---

Description Summary:
Gitea versions up to 1.26.2 contain a vulnerability involving incomplete SSRF protection within the webhook and migration allow-list filtering mechanisms.

Executive Summary:
A critical Server-Side Request Forgery (SSRF) vulnerability in Gitea allows unauthorized actors to potentially interact with internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-22874

Affected Software: Gitea Gitea Open Source Git Server

Affected Versions: Up to and including 1.26.2

Vulnerability: The software fails to properly sanitize input during webhook and migration processes, leading to incomplete SSRF protection. This flaw allows an attacker to bypass allow-list filtering to send unauthorized requests to internal services.

Business Impact

The exploitation of this SSRF vulnerability poses a severe risk to internal network security. An attacker could leverage this flaw to perform unauthorized reconnaissance, interact with internal APIs, or access sensitive metadata services, potentially leading to full service compromise. With a CVSS score of 9.6, this vulnerability is critical and requires immediate attention to prevent unauthorized lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade Gitea to the latest patched version provided by the vendor to eliminate the SSRF vector.

Proactive Monitoring: Review web server and application logs for unusual outbound connection attempts originating from the Gitea instance to internal IP addresses or restricted ports.

Compensating Controls: Implement strict egress filtering on the firewall to restrict the Gitea server from reaching internal network segments or unauthorized external endpoints.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Jul 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS score of 9.6, organizations must prioritize the update of all Gitea instances. Failure to address this SSRF vulnerability exposes the internal infrastructure to significant risk; patching is the only definitive way to mitigate this exposure.

---METADATA---
VENDOR: Gitea
PRODUCT: Gitea Open Source Git Server
AFFECTED_VERSIONS: Gitea versions before 1.25.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Gitea versions before 1.25.5 contain an improper input validation vulnerability in repository creation fields, potentially allowing unauthorized data manipulation.

Executive Summary:
A critical input validation vulnerability in Gitea versions before 1.25.5 allows unauthenticated attackers to manipulate repository creation parameters, posing a risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-22547

Affected Software: Gitea Open Source Git Server

Affected Versions: Gitea versions before 1.25.5

Vulnerability: The software fails to enforce sufficient validation constraints (CWE-20) on repository creation fields, specifically regarding length-limited template fields, trust models, and object format values. This flaw allows an attacker to submit malformed input that the application processes incorrectly, leading to potential unauthorized access or configuration tampering.

Business Impact

With a CVSS score of 9.1, this vulnerability is classified as Critical. Successful exploitation could lead to unauthorized access to sensitive code repositories, potential data exposure, or the injection of malicious configurations into the development pipeline. Given the role of Gitea as a central Git server, the integrity of the entire software development lifecycle is at risk.

Remediation Plan

Immediate Action: Upgrade your Gitea instance to version 1.25.5 or later immediately to apply the necessary input validation constraints.

Proactive Monitoring: Review application access logs for unusual repository creation requests or attempts to inject large or malformed data into configuration fields.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict input validation rules to filter out anomalous payloads targeting repository creation endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score and the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high severity of this vulnerability necessitates an immediate update to version 1.25.5. Organizations should ensure their Gitea instances are patched promptly to prevent unauthorized manipulation of repository settings and to maintain the security posture of their development environment.

Executive Summary:
A high-severity vulnerability has been discovered in multiple Gitea products, identified as CVE-2025-68939 with a CVSS score of 8.2. This flaw could allow a remote, unauthenticated attacker to bypass access controls and gain unauthorized access to private code repositories. Successful exploitation could lead to intellectual property theft, malicious code injection into the software supply chain, and significant operational disruption.

Vulnerability Details

CVE-ID: CVE-2025-68939

Affected Software: Gitea Multiple Products

Affected Versions: See vendor advisory for specific affected versions. The vulnerability is described as affecting versions "before 1.x.x".

Vulnerability: This vulnerability is an authentication bypass flaw within Gitea's repository access control mechanism. Due to improper handling of user session validation when accessing specific Git API endpoints, a specially crafted request can allow an unauthenticated attacker to circumvent security checks. An attacker can exploit this by sending a malformed HTTP request to a target Gitea instance, which tricks the system into granting access to private repositories as if the request were from an authorized user.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.2. Exploitation could have severe consequences for the organization, including the theft of proprietary source code, trade secrets, and other sensitive intellectual property stored in private repositories. An attacker could also tamper with code, potentially introducing backdoors or malware, leading to a software supply chain compromise. The exposure of private data could result in significant reputational damage, loss of customer trust, and potential regulatory fines.

Remediation Plan

Immediate Action: The primary and most effective remediation is to apply the security updates provided by the vendor immediately. After patching, it is critical to monitor for any signs of exploitation attempts that may have occurred prior to the update and to review all repository access logs for anomalous activity.

Proactive Monitoring: Security teams should monitor for unusual access patterns to Git repositories, such as multiple failed login attempts followed by a success, access from unfamiliar IP addresses or geographic locations, or an unusual volume of cloning/fetching activity. Review web server and Gitea application logs for malformed HTTP requests targeting repository access endpoints.

Compensating Controls: If immediate patching is not feasible, consider implementing compensating controls. Place the Gitea instance behind a Web Application Firewall (WAF) with rules designed to block maliciously crafted requests. Restrict network access to the Gitea instance to only trusted IP ranges and enforce mandatory multi-factor authentication (MFA) for all users as an additional layer of security.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, December 27, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, given the high severity and the critical nature of the assets protected by Gitea, it is highly likely that threat actors will develop exploits in the near future.

Analyst Recommendation

Given the high CVSS score and the direct threat to an organization's intellectual property, we strongly recommend that all affected Gitea instances be patched on an emergency basis. This vulnerability represents a critical risk of data exfiltration and supply chain compromise. Although this CVE is not currently listed on the CISA KEV catalog, its severity makes it a prime candidate for future inclusion and a high-value target for attackers. Organizations must prioritize this update and conduct a thorough review of access logs to detect any potential compromise.