Gitea pull-request branch updates use insufficient permission checks

Gitea fork synchronization can expose private parent repository data

Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check

Repository Visibility Manipulation via Git Push Options

Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Gitea LFS object reuse bypasses Code-unit authorization

Gitea TOTP single-use enforcement defect allows OTP replay

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

Gitea runner registration-token GET endpoint performs a write under a read-only token scope

Repository migration SSRF via multi-answer DNS allow-list bypass

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

SSRF via HTTP Redirect in Repository Migration

Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes

Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure

Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea SSH Key Parser Denial of Service

Gitea redirect handling permits open redirects through backslash paths

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

Cross-repository issue/comment attachment re-linking can expose private attachment content

Gitea LFS Deploy-Key Privilege Escalation

Email Management API Bypasses ManageCredentials Feature Restrictions

Private Repository Existence Disclosure via go-get Meta Endpoint

Gitea repository dumps write release assets using unsafe path names

Gitea tracked-time deletion can target entries from another issue

Gitea tracked-time list endpoint has insufficient permission checks

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Local File Inclusion via file:// URI in Migration Restore

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Public-only API token restriction is not enforced on team API routes

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Gitea issue-template APIs bypass repository unit authorization

Gitea repository feeds bypass API token scope enforcement

Gitea user organization API bypasses public-only token filtering

Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)

Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Webhook Authorization Header Returned in Plaintext via API

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service