gitea
v28.3.0Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD
- Maintenance
- Active1041 commits in 3 months · bus factor 5
- License
- MITPermissive · OSI-approved
- Security
- 30 advisories8 high, 19 medium, 3 low · Scorecard 7.1/10
- Supported versions
- No scheduleendoflife.date does not track this project
59.1k stars · 7.4k forks · 2.2k open issues · last release 14 days ago · data checked 3 hours ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 8 high, 19 medium, 3 low. Check the patched version against the one you run.
- highGHSA-7c33-wq58-g35rNov 13, 2026Runner cache shared entries across branches, letting branch writers poison default-branch builds
- Affected
- < 5.3.0
- Patched in
- 5.3.0
- mediumCVE-2026-119625Nov 1, 2026GET /{user}.rss / .atom leak private activity to a scope-confined API token (2nd incomplete-fix follow-up of GHSA-6cqf-375w-639g, user feed never got the scope-category check the repo feeds did)
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- mediumCVE-2026-112887Nov 1, 2026Gitea Actions task tokens authenticate to the REST API with no token scope, enabling instance-wide private repository enumeration via GET /api/v1/user/repos
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- mediumCVE-2026-116474Nov 1, 2026Actions token can spoof instance-signed commits by adding a GPG key
- Affected
- >= 1.19.0, <= 28.2.0
- Patched in
- 28.3.0
- mediumCVE-2026-119533Nov 1, 2026Public project boards disclose private pull request titles and repository names
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- mediumCVE-2026-118504Nov 1, 2026API Issue Mutation Archive Restriction Bypass
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- mediumCVE-2026-117677Nov 1, 2026Helm chart upload: unbounded gzip+tar metadata parse before the package-size quota gate (CWE-409/CWE-400 decompression amplification)
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- mediumCVE-2026-117649Nov 1, 2026Cross-repository issue dependency and timeline read path serializes private issue title/body and attachments without the source repository access check (LoadDepIssueDetails/ToAPIIssue without ACL)
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- mediumCVE-2026-118395Nov 1, 2026Deprecated POST /org/{org}/repos skips rejectPublicOnly; public-only tokens can create private repositories
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- mediumCVE-2026-117646Nov 1, 2026Public-only tokens expose private repositories through profile and organization tabs
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- mediumCVE-2026-116289Nov 1, 2026Public-only PAT scope bypass via Actions runner registration leaks private repository secrets
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- mediumCVE-2026-114199Nov 1, 2026Contribution heatmap discloses private-repository contribution counts to public-only tokens (GetUserHeatmapData never reads ctx.PublicOnly while activity feeds do)
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- mediumCVE-2026-119627Nov 1, 2026Gitea web profile and feed routes bypass public-only token scope for limited-visibility users
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- mediumCVE-2026-118394Nov 1, 2026OIDC userinfo: the public-only token scope is not enforced when the token arrives as a query parameter (residual of CVE-2026-55982)
- Affected
- >= 1.23.0, <= 28.2.0
- Patched in
- 28.3.0
- highCVE-2026-113429Nov 1, 2026Stored XSS on the Gitea origin through the v3 artifact Content-Encoding header
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- highCVE-2026-116296Nov 1, 2026Write collaborators can replace and destroy releases, milestones and labels on archived repositories (archived write-protection bypass)
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- highCVE-2026-119441Nov 1, 2026Public-Only Token Bypass on Bulk Organization Repository Deletion
- Affected
- >= 1.27.0, <= 28.2.0
- Patched in
- 28.3.0
- highCVE-2026-117635Nov 1, 2026Public-only tokens bypass private-resource restrictions on the admin API
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- highCVE-2026-117685Nov 1, 2026Public-only package tokens can access private OCI blobs
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- highCVE-2026-120263Nov 1, 2026Account Takeover via OAuth2 Auto-Linking with Attacker-Controlled Username
- Affected
- <= 28.2.0
- Patched in
- 28.3.0
- highCVE-2026-118386Nov 1, 2026Actions: fork workflow gets secrets and write token via review commit_id
- Affected
- >= 1.19.0, <= 28.2.0
- Patched in
- 28.3.0
- lowCVE-2026-97859Oct 18, 2026API routes for user social graph, keys, and starred repos bypass private visibility check
- Affected
- <= 1.27.2
- Patched in
- 1.27.3
- lowCVE-2026-107618Oct 18, 2026Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`
- Affected
- <= 28.1.0
- Patched in
- 28.2.0
- lowCVE-2026-97204Oct 18, 2026DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels
- Affected
- <= 28.1.0
- Patched in
- 28.2.0
- mediumCVE-2026-109844Oct 18, 2026Gitea watched-repos API (GET /api/v1/user/subscriptions) leaks private repository metadata after team permission downgrade
- Affected
- <= 1.26.4
- Patched in
- 1.27.0
- mediumCVE-2026-110324Oct 18, 2026Private profile information leaks on POST request
- Affected
- >= 1.22.0, <= 28.0.0
- Patched in
- 28.1.0
- mediumCVE-2026-105964Oct 18, 2026Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS
- Affected
- >= 1.22.0, <= 28.1.0
- Patched in
- 28.2.0
- mediumCVE-2026-110311Oct 18, 2026Draft releases include attachment metadata from other repositories
- Affected
- >= 1.22.0, <= 28.1.0
- Patched in
- 28.2.0
- mediumCVE-2026-105661Oct 18, 2026Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users
- Affected
- <= 28.1.0
- Patched in
- 28.2.0
- mediumCVE-2026-110494Oct 18, 2026Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases
- Affected
- <= 28.1.0
- Patched in
- 28.2.0