Privilege Escalation via Access Token Scope Escalation in API

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Gitea pre-receive hook can miss branch-protection checks after scanner errors

Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions

Gitea Docker image trusts spoofable reverse-proxy headers by default

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea webhook and migration allow-list filtering permits SSRF

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Public-only repository tokens can update private PR head branches

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange

Gitea OAuth2 authorization codes lack expiry and reuse enforcement

Gitea template repository generation mishandles symlinked paths

Gitea repository creation accepts invalid field values

Gitea repository archive downloads bypass token scope checks

Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure

Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)

Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)