| CVE-2026-25779 | TRUNG BÌNH6.1 | Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values. | 03/07/2026 |
| CVE-2026-20912 | NGHIÊM TRỌNG9.1 | Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users. | 22/01/2026 |
| CVE-2026-20904 | TRUNG BÌNH6.5 | Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities. | 22/01/2026 |
| CVE-2026-20897 | NGHIÊM TRỌNG9.1 | Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories. | 22/01/2026 |
| CVE-2026-20888 | TRUNG BÌNH4.3 | Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users. | 22/01/2026 |
| CVE-2026-20883 | TRUNG BÌNH6.5 | Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches. | 22/01/2026 |
| CVE-2026-20800 | TRUNG BÌNH6.5 | Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications. | 22/01/2026 |
| CVE-2026-20750 | NGHIÊM TRỌNG9.1 | Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization. | 22/01/2026 |
| CVE-2022-42968 | NGHIÊM TRỌNG9.8 | Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled. | 16/10/2022 |
| CVE-2021-45329 | TRUNG BÌNH6.1 | Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field. | 08/02/2022 |
| CVE-2021-45328 | TRUNG BÌNH6.1 | Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. | 08/02/2022 |
| CVE-2021-45327 | NGHIÊM TRỌNG9.8 | Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code. | 08/02/2022 |
| CVE-2021-45326 | CAO8.8 | Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests. | 08/02/2022 |
| CVE-2021-45325 | CAO7.5 | Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL. | 08/02/2022 |
| CVE-2021-3382 | CAO7.5 | Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path. | 05/02/2021 |
| CVE-2020-28991 | NGHIÊM TRỌNG9.8 | Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo_form.go. | 24/11/2020 |
| CVE-2020-13246 | CAO7.5 | An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another. | 20/05/2020 |
| CVE-2019-11229 | CAO8.8 | models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution. | 15/04/2019 |
| CVE-2019-11228 | CAO7.5 | repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. | 15/04/2019 |
| CVE-2018-1000803 | TRUNG BÌNH5.3 | Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email set as private. This vu | 08/10/2018 |