Privilege Escalation via Access Token Scope Escalation in API

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Gitea pre-receive hook can miss branch-protection checks after scanner errors

Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions

Gitea Docker image trusts spoofable reverse-proxy headers by default

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea webhook and migration allow-list filtering permits SSRF

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Public-only repository tokens can update private PR head branches

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange

Gitea OAuth2 authorization codes lack expiry and reuse enforcement

Gitea template repository generation mishandles symlinked paths

Gitea repository creation accepts invalid field values

Gitea repository archive downloads bypass token scope checks

Permanent Fork PR Workflow Approval Gate Bypass

Gitea pre-receive hook permission cache allows full repository write access

Gitea 3D file viewer allows stored XSS through glTF extensionsRequired

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Gitea maintainer-edit permissions allow unauthorized commits to readable repositories

Gitea Composer package source links use insufficient permission checks

Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Gitea Git smart HTTP bypasses repository token scopes for bearer tokens

Gitea Basic Auth bypasses OAuth2 access token scopes

Gitea organization forks can expose organization secrets without create permission

Two SSRF findings in Gitea 1.26.2

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Private Repository Metadata Remains Accessible After Access Revocation

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

REST API exposes organization membership of private organizations to public

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Notification API leaks private issue metadata after access revocation

Gitea forwarded-proto handling allows public URL spoofing

Gitea draft releases use insufficient permission checks

Gitea email settings allow changing another user's primary email address

Gitea git grep search lacks a timeout

Gitea organization permission APIs expose private visibility information

Gitea private organization labels are visible to unauthorized users

Gitea pull-request branch updates use insufficient permission checks

Gitea fork synchronization can expose private parent repository data

Repository Visibility Manipulation via Git Push Options