SB2026081541 - Multiple vulnerabilities in Gitea

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081541

SB2026081541 - Multiple vulnerabilities in Gitea

Published: August 15, 2026

Security Bulletin ID SB2026081541
CSH Severity
High
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 14% Medium 43% Low 43%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-73539)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of argument delimiters in external renderer command handling when processing a crafted markup Context value. A remote user can inject additional command-line arguments into the renderer invocation to execute arbitrary code.

Exploitation requires external markup rendering to be enabled with a RENDER_COMMAND containing $GITEA_PREFIX_SRC or $GITEA_PREFIX_RAW, filesystem-backed APP_DATA_PATH, and repository write access to upload a payload file to a predictable path.


2) Incorrect Privilege Assignment (CVE-ID: CVE-2026-73814)

CWE-ID: CWE-266 - Incorrect Privilege Assignment

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges and transfer a repository.

The vulnerability exists due to incorrect privilege assignment in the collaboration access-mode endpoint when handling submitted collaboration permission changes. A remote privileged user can submit mode=4 to grant themselves effective Owner permissions to escalate privileges and transfer a repository.

The issue affects repositories owned by regular user accounts as well as organization-owned repositories.


3) Cross-site scripting (CVE-ID: CVE-2026-60008)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to display arbitrary full-screen content on the Gitea origin and intercept clicks.

The vulnerability exists due to improper neutralization of input during web page generation in the Jupyter notebook renderer when rendering a crafted notebook with attacker-controlled language metadata into unsanitized, unsandboxed output. A remote user can commit or upload a specially crafted notebook file to display arbitrary full-screen content on the Gitea origin and intercept clicks.

Exploitation requires write access to the repository containing the notebook, and users must open the affected repository page or rendered notebook content.


4) Missing Critical Step in Authentication (CVE-ID: CVE-2026-73535)

CWE-ID: CWE-304 - Missing Critical Step in Authentication

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass second-factor authentication and take over accounts.

The vulnerability exists due to missing critical step in authentication in the POST /user/openid/connect handler when processing OpenID connect sign-in requests. A remote user can submit a known victim password through the OpenID connect flow to bypass second-factor authentication and take over accounts.

OpenID sign-in is enabled by default on instances set up through the installer. On affected accounts, an attacker-controlled OpenID identifier can be linked before sign-in completes, allowing subsequent access without the victim\'s password and surviving password changes until the linked identifier is removed.


5) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2026-73800)

CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute attacker-controlled workflow code and disclose sensitive information.

The vulnerability exists due to inclusion of functionality from an untrusted control sphere in local reusable workflow resolution when processing pull_request_target events that call local reusable workflows. A remote user can open a pull request from a fork containing a crafted reusable workflow to execute attacker-controlled workflow code and disclose sensitive information.

Only instances with Gitea Actions enabled and a pull_request_target workflow that calls a local reusable workflow via ./ or the $/ same-repo form are vulnerable.


6) Improper Authentication (CVE-ID: CVE-2026-73278)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass webauthn-based second-factor authentication and gain a full authenticated session.

The vulnerability exists due to improper authentication in OAuth2 and OpenID Connect sign-in handlers when handling OAuth2 or OpenID Connect sign-in flows for accounts that use WebAuthn as their only configured second factor. A remote attacker can authenticate through an affected OAuth sign-in path to bypass webauthn-based second-factor authentication and gain a full authenticated session.

One affected sign-in path can also persist an external identity link to the victim account, which can extend access beyond a single session. Password-based login continued to enforce the WebAuthn challenge.


7) Incorrect authorization (CVE-ID: CVE-2026-73804)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass API token scope restrictions and perform unauthorized API actions.

The vulnerability exists due to incorrect authorization in HTTP Signature authentication and route-level scope enforcement when processing HTTP Signature-authenticated API requests created from a user-scoped token. A remote user can add an attacker-controlled SSH public key to the account and sign API requests to bypass API token scope restrictions and perform unauthorized API actions.

The resulting access is constrained by the compromised account\'s normal RBAC permissions, but API token scope checks are skipped because the request is marked as API-token authenticated without an associated scope.


Remediation

Install update from vendor's website.

References