SB2026071452 - Multiple vulnerabilities in Gitea

Security Bulletin ID SB2026071452

CSH Severity

Medium

Patch available

YES

Number of vulnerabilities 46

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 46 vulnerabilities.

1) Improper access control (CVE-ID: CVE-2026-58437)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify repository visibility or template status without triggering normal repository change controls.

The vulnerability exists due to improper access control in HookPostReceive() in routers/private/hook_post_receive.go when processing git push options on existing repositories. A remote user can send a git push with the undocumented repo.private or repo.template option to modify repository visibility or template status without triggering normal repository change controls.

The issue bypasses audit and activity logging, webhook delivery, owner notifications, team permission recalculation, and updated_at timestamp changes.

2) Incorrect authorization (CVE-ID: CVE-2026-58431)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the /api/v1/teams/{id} API routes when handling requests with a public-only access token. A remote user can send crafted API requests to disclose sensitive information.

Private team repository metadata and private team activity feed entries may be exposed through affected team endpoints.

3) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-56657)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled algorithmic complexity in the SSH key parser when processing RFC 4716 (SSH2) public keys submitted to the user SSH key ingestion endpoint. A remote user can send a specially crafted key submission to cause a denial of service.

The issue can be triggered through a POST request to /api/v1/user/keys with a Bearer token, and the key is normalized before its validity is checked.

4) Insufficient Session Expiration (CVE-ID: CVE-2026-56750)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to maintain persistent access to a victim's account.

The vulnerability exists due to improper session expiration in Remember-Me token validation logic when handling a compromised Remember-Me cookie with a hash mismatch. A remote user can use a stolen Remember-Me token to maintain persistent access to a victim's account.

The issue affects POST /user/login and any endpoint that triggers autoSignIn via the Remember-Me cookie.

5) Resource exhaustion (CVE-ID: CVE-2026-56755)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in ParseControlFile when processing an uploaded .deb file containing a crafted compressed control.tar.gz member. A remote user can upload a specially crafted package to cause a denial of service.

The issue is triggered before content validation runs.

6) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-57886)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose private attachment content.

The vulnerability exists due to authorization bypass through user-controlled key in web issue/comment attachment handling when updating issue or comment attachments with attachment UUIDs. A remote user can submit a known attachment UUID through issue or comment edit flows to disclose private attachment content.

The issue can also alter the attachment's logical issue or comment association, and exploitation requires knowledge of a high-entropy attachment UUID.

7) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-57894)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information from internal Git repositories.

The vulnerability exists due to server-side request forgery (SSRF) in repository migration and pull mirror synchronization when processing a user-supplied Git URL that returns an HTTP redirect. A remote user can submit an allowed public Git URL that redirects to an internal Git HTTP(S) endpoint to disclose sensitive information from internal Git repositories.

Pull mirror configurations can cause scheduled fetch operations to continue retrieving future commits from the redirected internal repository.

8) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-58436)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in the Locale middleware when processing a crafted Accept-Language header. A remote attacker can send a specially crafted request to cause a denial of service.

The issue affects unauthenticated requests and can be triggered through a single GET request to endpoints reached through the global web request pipeline.

9) Incorrect authorization (CVE-ID: CVE-2026-57897)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information from private repositories within an organization.

The vulnerability exists due to incorrect authorization in the org-level Actions run and job API endpoints when handling requests to list workflow runs or jobs for an organization. A remote user can send requests to the org-level Actions APIs to disclose sensitive information from private repositories within an organization.

The affected endpoints expose workflow metadata across repositories in the organization without enforcing per-repository access control checks, enabling enumeration and search over private workflow history.

10) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-58314)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information from internal services via server-side request forgery.

The vulnerability exists due to improper restriction of server-side request forgery in the hostmatcher external builtin when processing webhook delivery or repository migration requests to CGNAT and other non-routable address families. A remote user can configure a crafted webhook target or migration URL to disclose sensitive information from internal services via server-side request forgery.

For webhook delivery, the response status, headers, and body up to 1 MB are stored and rendered to the webhook owner.

11) Incorrect authorization (CVE-ID: CVE-2026-58425)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information about OAuth tokens issued to other clients.

The vulnerability exists due to incorrect authorization in the IntrospectOAuth endpoint when handling token introspection requests. A remote user can submit another client's access or refresh token to disclose sensitive information about OAuth tokens issued to other clients.

The issue affects responses from the OAuth introspection endpoint and can expose token status, scope, username, and registered claims including the issuing client identifier.

12) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose the existence of private repositories.

The vulnerability exists due to improper access control in the go-get meta endpoint when handling go get requests for repository paths. A remote attacker can send a specially crafted request to disclose the existence of private repositories.

The issue can be triggered using the insecure go-get mechanism against repository paths that should not reveal whether a private repository exists.

13) Improper access control (CVE-ID: CVE-2026-56654)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper access control in the personal access token creation API endpoint when processing a token supplied in the Authorization Basic :x-oauth-basic format. A remote user can send a specially crafted API request to escalate privileges.

The issue arises because token-based authentication is misclassified as basic authentication, allowing the password-authentication guard to be bypassed, and the created token is not restricted to the caller's existing token scope.

14) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-58508)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to access internal network resources via server-side request forgery.

The vulnerability exists due to improper access control in services/migrations/migrate.go when processing migration URLs. A remote user can supply a URL that passes the initial DNS-based check and then rebind DNS resolution to access internal network resources via server-side request forgery.

Exploitation requires control over DNS responses for the target host and relies on rebinding between the validation step and the subsequent git fetch operation.

15) Improper Preservation of Permissions (CVE-ID: CVE-2026-58510)

CWE-ID: CWE-281 - Improper preservation of permissions

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper preservation of permissions in the updateRepository helper when processing API requests that change a repository from public to private. A remote user can use the REST API to make a watched public repository private without clearing stale watch records to disclose sensitive information.

The issue affects the API path PATCH /api/v1/repos/{owner}/{repo}; stale watch records can expose the private repository through the subscriptions endpoint and keep the visible watch count inflated.

16) Improper Protection of Alternate Path (CVE-ID: CVE-2026-58428)

CWE-ID: CWE-424 - Improper Protection of Alternate Path

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass release attachment extension restrictions.

The vulnerability exists due to improper protection of alternate path in the EditReleasePost web release edit handler and release attachment rename logic when handling attachment rename form fields. A remote user can submit a specially crafted web release edit form to bypass release attachment extension restrictions.

Exploitation requires repository write permission and a non-empty release attachment allowlist to be configured.

17) Missing Authorization (CVE-ID: CVE-2026-58432)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to missing authorization in the ServeAttachment web attachment handler when handling UUID-based attachment download requests for draft release assets. A remote attacker can obtain or use a draft release attachment UUID and request a web attachment endpoint to disclose sensitive information.

The issue affects web-level attachment routes that do not enforce the draft-release access check, and exploitation requires knowledge of an attachment UUID.

18) Information disclosure (CVE-ID: CVE-2026-58511)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in the ToHook() function in services/webhook/general.go when handling API requests for webhook data. A remote privileged user can retrieve webhook details to disclose sensitive information.

The issue exposes plaintext webhook authorization headers, including Bearer tokens, Basic authentication credentials, and API keys, that were configured by other administrators.

19) Input validation error (CVE-ID: CVE-2026-59763)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the Arch package registry metadata parser and repository index generation when processing uploaded Arch package archives. A remote user can upload a specially crafted package archive with a large number of file entries to cause a denial of service.

The issue requires package publishing permission and can amplify server-side CPU, memory, storage, and repository index processing relative to the compressed upload size.

20) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-23603)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause the server to make arbitrary outbound HTTP requests.

The vulnerability exists due to server-side request forgery (ssrf) in OAuth2 avatar synchronization when fetching the OIDC picture claim URL. A remote user can supply a crafted avatar URL to cause the server to make arbitrary outbound HTTP requests.

Only instances with [oauth2_client] UPDATE_AVATAR = true enabled are vulnerable. The issue is blind by default, but limited response retrieval may be possible if a reachable internal endpoint returns a valid supported image within the configured avatar size limit.

21) Improper Restriction of Security Token Assignment (CVE-ID: CVE-2026-58429)

CWE-ID: CWE-1259 - Improper Restriction of Security Token Assignment

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the organization and permission endpoints when handling requests with a public-only personal access token. A remote privileged user can send a specially crafted request to disclose sensitive information.

The issue affects GET /api/v1/user/orgs and GET /api/v1/users/{username}/orgs/{org}/permissions. A public-only token for a user who belongs to private organizations can reveal private organization membership and organization role details for that same account.

22) Improper Authorization (CVE-ID: CVE-2026-58439)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass branch protection and merge changes into a protected branch without legitimate maintainer approval.

The vulnerability exists due to improper access control in pull request review approval handling when changing a pull request's target branch. A remote user can obtain an approval on an unprotected branch and retarget the pull request to a protected branch to bypass branch protection and merge changes into a protected branch without legitimate maintainer approval.

Exploitation requires write access to the repository and the ability to obtain an approval from a non-whitelisted account before retargeting the pull request.

23) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-59765)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information from internal services and local files.

The vulnerability exists due to server-side request forgery (SSRF) in migration asset download handling and related URI fetching code when processing user-supplied download URLs. A remote user can supply a specially crafted URL to disclose sensitive information from internal services and local files.

Exploitation through the migration path requires permission to trigger a repository migration, and the issue can be abused with http:// URLs to reach internal network resources or with file:// URLs to read local files.

24) Missing Authorization (CVE-ID: CVE-2026-50105)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in RSS/Atom feed handlers when processing API-token Basic authentication requests for feed routes. A remote user can use a public-only or wrong-scope personal access token to disclose sensitive information.

The issue affects feed endpoints that expose private commit metadata, release or tag notes, and the token owner's private activity stream, while normal repository read checks are still enforced.

25) Missing Authorization (CVE-ID: CVE-2026-58433)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to grant unauthorized repository access to team members.

The vulnerability exists due to missing authorization in the AddTeamRepository API endpoint when linking a team to a repository through the team-repository endpoint. A remote user can send a crafted api request to grant unauthorized repository access to team members.

The issue bypasses the organization's RepoAdminChangeTeamAccess setting and can expose private repository contents to current and future members of the linked team.

26) Improper access control (CVE-ID: CVE-2026-58440)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in DeleteCollaboration and webhook delivery when handling repository events after collaborator access is revoked. A remote privileged user can create a webhook on a private repository before revocation to disclose sensitive information.

The webhook may remain active after the collaborator loses repository access, and future event payloads can include issue and comment bodies and commit data sent to an attacker-controlled endpoint.

27) Improper access control (CVE-ID: CVE-2026-20800)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in /api/v1/user/starred and /api/v1/user/times when handling requests for user-starred repositories and tracked time entries. A remote user can query these endpoints after access revocation to disclose sensitive information.

The issue leaks metadata from private repositories, including repository objects and private issue titles, after the user's access has been revoked.

28) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-58441)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to server-side request forgery in the restore-repo command when processing a crafted repository dump containing a malicious pull_request.yml Head.CloneURL value. A remote attacker can trick an administrator into restoring a crafted dump to disclose sensitive information.

User interaction is required to run the restore-repo CLI command against a malicious dump. The issue can also cause the server to initiate git fetch requests to attacker-chosen URLs, including internal network targets and file:// paths readable by the Gitea process.

29) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-58442)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information from internal-only Git services via server-side request forgery.

The vulnerability exists due to improper access control in services/migrations/migrate.go when validating repository migration destinations that resolve to multiple IP addresses. A remote user can use an attacker-controlled DNS hostname that resolves to both allowed and blocked addresses to disclose sensitive information from internal-only Git services via server-side request forgery.

The issue arises because the validation accepts a hostname if any resolved IP is allowed, while the later git clone operation performs DNS resolution again and can connect to a blocked internal address.

30) Incorrect authorization (CVE-ID: CVE-2026-58443)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify a private pull request head branch.

The vulnerability exists due to incorrect authorization in the pull request update endpoint when handling update requests for a pull request from a public base repository to a private head repository. A remote user can send a specially crafted update request to modify a private pull request head branch.

Exploitation requires a valid public-only,write:repository token for a user who has normal write permission to the private head branch. When Actions is enabled on the private head repository, the server-side push also triggers matching push workflows.

31) Incorrect authorization (CVE-ID: CVE-2026-58444)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose private repository contents.

The vulnerability exists due to incorrect authorization in the repository home page route (`GET /{owner}/{repo}` / `repo.Home`) when handling HTTP Basic authentication with a personal access token or OAuth2 token lacking the `repository` scope or restricted to public repositories. A remote user can send a request to the repository home page to disclose private repository contents.

The disclosure is limited to the repository root view and includes the rendered README, root file and directory listing, description, language statistics, license, and latest-release information.

32) Improper access control (CVE-ID: CVE-2026-58427)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the /orgs/{org}/members API endpoint when handling requests for organization member listings. A remote user can send a request to enumerate members of a private organization to disclose sensitive information.

The issue affects the ListMembers endpoint but not the public_members endpoints addressed by the earlier change.

33) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-58445)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose limited sensitive information.

The vulnerability exists due to authorization bypass through user-controlled key in the DeleteIssueLabel API endpoint when handling DELETE requests for issue labels by ID. A remote privileged user can send a specially crafted request with arbitrary label IDs to disclose limited sensitive information.

The issue creates an oracle in which response status distinguishes whether a label ID exists anywhere on the instance, including labels in repositories or organizations the user cannot access. No cross-repository write occurs, and no label name, color, or owning repository is disclosed.

34) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-42931)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the AddPackageTag NPM package tag API endpoint when handling a crafted HTTP PUT request body. A remote user can send a single large request body to cause a denial of service.

No package needs to exist for exploitation, and concurrent requests can repeatedly crash the server after automatic restarts.

35) Incorrect authorization (CVE-ID: CVE-2026-58416)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to incorrect authorization in GetActionsUserRepoPermission in models/perm/access/repo_permission.go when handling fork pull-request Actions task access to a collaborative-owner private repository. A remote user can submit a specially crafted fork pull request workflow to disclose sensitive information.

Exploitation requires the target private repository to trust the base repository owner as a collaborative owner, the base repository to be private, and the fork pull-request workflow to run.

36) Missing Authorization (CVE-ID: CVE-2026-58438)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to tamper with issue dependency relationships and inject comments into private repositories.

The vulnerability exists due to improper access control in the RemoveDependency action in routers/web/repo/issue_dependency.go when handling issue dependency removal requests. A remote user can send a specially crafted request with a dependency issue ID to tamper with issue dependency relationships and inject comments into private repositories.

Exploitation requires write access to issues in one repository and an existing cross-repository dependency link to an issue in a private repository. No repository content is disclosed.

37) Improper access control (CVE-ID: CVE-2026-58417)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the "/orgs/{org}/public_members/{username}" REST API endpoint when handling GET requests for public member lookups in private organizations. A remote user can send a crafted API request to disclose sensitive information.

The issue leaks whether a user is a member of a private organization through the endpoint response.

38) Improper Certificate Validation (CVE-ID: CVE-2026-54481)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and compromise internal API functionality.

The vulnerability exists due to improper certificate validation in modules/private/internal.go when handling internal API HTTPS connections to a non-loopback target. A remote attacker can perform a man-in-the-middle attack and capture the internal authentication token to disclose sensitive information and compromise internal API functionality.

The issue is exposed in split-host or multi-pod deployments where LOCAL_ROOT_URL uses HTTPS to a non-loopback endpoint, and captured tokens can be replayed against /api/internal/* endpoints on the main HTTP listener.

39) Missing Authorization (CVE-ID: CVE-2026-58434)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive repository metadata.

The vulnerability exists due to missing authorization in the GET /api/v1/user/starred and GET /api/v1/user/subscriptions endpoints when handling requests for private repository lists after access revocation. A remote user can request the affected endpoint to disclose sensitive repository metadata.

Exploitation requires prior legitimate access to the private repository and occurs after that access has been revoked.

40) Information disclosure (CVE-ID: CVE-2026-55982)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the OIDC userinfo endpoint when handling bearer-authenticated requests with API tokens. A remote user can send a request with a narrowly scoped personal access token to disclose sensitive information.

The issue is limited to identity claims associated with the authenticated user, including email address and group membership information.

41) NULL pointer dereference (CVE-ID: CVE-2026-55984)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the AddTime API handler in routers/api/v1/repo/issue_tracked_time.go when handling POST requests to add tracked time with a non-existent user name. A remote privileged user can send a specially crafted API request to cause a denial of service.

Depending on deployment configuration and panic recovery behavior, exploitation may also result in request failures, stack trace disclosure, or excessive log generation.

42) Improper access control (CVE-ID: CVE-2026-55986)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass administrator-imposed credential management restrictions.

The vulnerability exists due to improper access control in the user email management API endpoints in routers/api/v1/user/email.go when handling requests to add or remove email addresses. A remote user can send crafted API requests to bypass administrator-imposed credential management restrictions.

The issue affects externally authenticated users when credential management is disabled for their authentication type, and the web interface enforces the restriction while the API does not.

43) Input validation error (CVE-ID: CVE-2026-58420)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to improper input validation in the migration restore release attachment handling when processing a crafted archive containing a release.yml file with a file:// DownloadURL. A local privileged user can supply a crafted archive or trick an administrator into restoring it to disclose sensitive information.

The issue affects the restore-repo command, and exfiltrated file contents are stored as release attachments retrievable through the Gitea API.

44) Incorrect Privilege Assignment (CVE-ID: CVE-2026-58435)

CWE-ID: CWE-266 - Incorrect Privilege Assignment

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information from private repositories.

The vulnerability exists due to incorrect privilege assignment in the Gitea LFS server and deploy-key authentication flow when handling SSH git-lfs-authenticate requests and subsequent HTTP LFS batch API requests. A remote user can use a write deploy key for one repository to obtain a valid LFS JWT and submit a crafted batch upload request to disclose sensitive information from other private repositories owned by the same victim.

Successful exploitation requires that the LFS server is enabled and that the attacker knows the SHA-256 OID of a target LFS object. If the victim is a site administrator, LFS objects across the entire instance may be reachable.

45) Incorrect authorization (CVE-ID: CVE-2026-55987)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to regain access to a deactivated account and obtain administrative access.

The vulnerability exists due to incorrect authorization in the OAuth2 sign-in callback when handling sign-in through an authentication source that does not issue refresh tokens. A remote user can sign in through the configured OAuth2 or OIDC provider to regain access to a deactivated account and obtain administrative access.

Only the "Activated" deactivation state is affected; accounts blocked with "Prohibit Login" remain unable to sign in.

46) Incorrect authorization (CVE-ID: CVE-2026-56443)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose limited-visibility repository and package content.

The vulnerability exists due to incorrect authorization in public-only personal access token scope checks for repository and package access controls when handling requests for resources owned by limited-visibility users or organizations. A remote user can use a public-only token to access repository and package endpoints to disclose limited-visibility repository and package content.

The issue affects repository and package scope categories, while sibling user and organization scope checks correctly reject the same access pattern.

Remediation

Install update from vendor's website.

SB2026071452 - Multiple vulnerabilities in Gitea

Breakdown by Severity

Description

Remediation

References

Please verify you're human