SB2026083147 - Multiple vulnerabilities in Gitea

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026083147

SB2026083147 - Multiple vulnerabilities in Gitea

Published: August 31, 2026

Security Bulletin ID SB2026083147
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 25
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 24% Low 76%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 25 vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2026-60018)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the OneDev migration downloader when processing the /~api/version/server response during a repository migration. A remote user can point a migration to a malicious OneDev-compatible server that returns an arbitrarily large or never-ending response body to cause a denial of service.

The issue is reachable through web, API, and background-task migration paths.


2) Incorrect authorization (CVE-ID: CVE-2026-70396)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to create unauthorized organization-owned repositories.

The vulnerability exists due to improper access control in the organization repository creation endpoint when handling POST requests to /api/v1/orgs/{org}/repos. A remote user can send a crafted API request using a token scoped only to write:organization to create unauthorized organization-owned repositories.

Exploitation requires that the authorizing user has organization create-repository permission, and the issue does not bypass organization membership or disclose existing private repository contents.


3) Incorrect authorization (CVE-ID: CVE-2026-70400)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to create private repositories and consume namespace or quota resources.

The vulnerability exists due to incorrect authorization in the repository migration endpoint when handling repository migration requests that set private: true while using a public-only token. A remote user can send a crafted migration request to create private repositories and consume namespace or quota resources.

The issue affects delegated tokens intended to be limited to public resources and can also start migration tasks under the authorizing account or an owned organization.


4) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-70402)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to incorrect permission assignment for critical resources in server-side Git hook directories and scripts when creating or synchronizing hooks during repository operations. A local user can modify an existing hook or add an executable file to a writable hook directory to execute arbitrary code.

Exploitation requires a permissive umask and access to the repository storage by another local principal, and a later Git operation triggers the injected hook as the Gitea service account.


5) Improper Authorization (CVE-ID: CVE-2026-70407)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper authorization in the GET /api/v1/orgs endpoint when handling API requests with a token that lacks the read:organization scope. A remote user can send a request to list organization metadata without the required scope to disclose sensitive information.

If the token belongs to a site administrator, the response can include limited and private organization metadata visible to that administrator.


6) Incorrect authorization (CVE-ID: CVE-2026-71184)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute attacker-controlled workflow code on the base repository's runners.

The vulnerability exists due to incorrect authorization in the review notifier for the pull_request_review_comment event when handling fork pull request review notifications without attaching the pull request. A remote user can open a fork pull request and submit a review with a line comment to execute attacker-controlled workflow code on the base repository's runners.

The workflow definition is loaded from the fork head, and the same code path also covers review approved and rejected events.


7) Improper access control (CVE-ID: CVE-2026-71301)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the markup preview route when resolving same-repository pull request references. A remote user can send a specially crafted POST request to disclose sensitive information.

Only pull request titles and displayed state are exposed; bodies, comments, and attachments are not returned.


8) Observable discrepancy (CVE-ID: CVE-2026-73504)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to confirm the association between an artifact ID and a named private repository.

The vulnerability exists due to observable discrepancy in the raw Actions artifact download endpoint when validating signed artifact download URLs. A remote attacker can submit requests with guessed global artifact IDs and an invalid signature to confirm the association between an artifact ID and a named private repository.

Artifact contents are not exposed, and inaccessible and nonexistent repositories return the same status.


9) Incorrect authorization (CVE-ID: CVE-2026-73126)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the workflow status badge endpoint when handling authenticated requests for private repository workflow badges. A remote user can use a deliberately restricted personal access token to retrieve the latest workflow run status of a private repository to disclose sensitive information.

The issue exposes whether a named private workflow most recently succeeded, failed, is waiting, or is running, and can be used to monitor private CI activity.


10) Resource exhaustion (CVE-ID: CVE-2026-73130)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the repository creation gitignores field when processing repository creation requests with auto-init enabled. A remote user can submit an overly long comma-separated value to cause a denial of service.

The issue is reachable through the repository creation form and the user and organization repository creation API endpoints only when automatic repository initialization is enabled.


11) Information disclosure (CVE-ID: CVE-2026-73135)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in repository listing endpoints when handling repository search, forks listing, or watched repository listing requests. A remote attacker can query these endpoints to disclose sensitive information.

The issue exposes repository metadata for repositories owned by hidden users, while direct routes to those repositories still return 404 responses.


12) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-73273)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the Maven checksum upload handler when processing checksum upload requests. A remote user can send a specially crafted checksum upload request to cause a denial of service.

Exploitation is reachable through checksum extension uploads such as .md5, .sha1, .sha256, and .sha512, and requires Maven package write access.


13) Incorrect authorization (CVE-ID: CVE-2026-60010)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to grant unauthorized repository access to organization teams.

The vulnerability exists due to improper access control in the repository-side team-link endpoint when handling PUT requests to /api/v1/repos/{owner}/{repo}/teams/{team}. A remote user can attach organization teams to a repository to grant unauthorized repository access to organization teams.

This occurs when the organization has disabled repository administrators from changing team access, and a non-owner repository administrator has delegated owner-level access through an attached admin team.


14) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-78433)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the web attachment handler when handling attachment requests through a repository path other than the repository that owns the attachment. A remote attacker can request a private repository attachment through a public repository attachment path to disclose sensitive information.

Exploitation requires knowledge of a specific attachment UUID, and only attachments created before 16 January 2026 are affected.


15) Resource exhaustion (CVE-ID: CVE-2026-60021)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the GitLab migration downloader version probe when requesting the remote /api/v4/version endpoint. A remote user can operate a GitLab-compatible server that keeps the response open indefinitely to cause a denial of service.

Only the initial version probe is unaffected by the migration task context, so cancellation does not interrupt the request. Exploitation is reachable by any authenticated user who can start a repository migration.


16) Resource exhaustion (CVE-ID: CVE-2026-62925)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the Alpine package upload handler when parsing an uploaded .apk file before package-size quota checks. A remote user can upload a small, highly compressible .apk with a .PKGINFO file containing a very large number of provides= lines to cause a denial of service.

The parsed metadata may remain allocated after serialization into package metadata and repository index rebuilding, increasing memory pressure. On memory-constrained deployments, the process may be terminated by the out-of-memory killer.


17) Resource exhaustion (CVE-ID: CVE-2026-63021)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Swift package upload manifest parsing when processing an uploaded archive containing many shallow Package.swift or Package@swift-N.swift manifests. A remote user can upload a small, highly compressible archive with many manifest files to cause a denial of service.

Each manifest file is checked only against an individual 128 KiB limit, while the number of manifests and their aggregate in-memory size are not bounded before quota enforcement.


18) Improper Handling of Insufficient Permissions or Privileges (CVE-ID: CVE-2026-63792)

CWE-ID: CWE-280 - Improper Handling of Insufficient Permissions or Privileges

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper handling of insufficient permissions or privileges in the CanReadWorkflowCrossRepo authorization logic when processing approved fork pull request Actions runs that reference reusable workflow files from another private repository. A remote user can open a fork pull request that causes the run to read reusable workflow file contents from a different private repository to disclose sensitive information.

The issue requires repository A to be private, repository B to list A's owner as a collaborative owner, and the approved run to execute. The workflow file path is limited to configured workflow directories, but the git ref is caller-controlled.


19) Improper access control (CVE-ID: CVE-2026-66849)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the package registry access check in determineAccessMode when handling requests for packages owned by Limited-visibility users. A remote user can enumerate and download package content to disclose sensitive information.

The issue affects restricted accounts that are logged in and applies to packages owned by Limited-visibility users.


20) Incorrect authorization (CVE-ID: CVE-2026-66853)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information about limited-visibility organizations.

The vulnerability exists due to improper access control in the user organization list API endpoint when listing the public organization memberships of a known user. A remote user can send a request to the `GET /api/v1/users/{username}/orgs` endpoint to disclose sensitive information about limited-visibility organizations.

A restricted account can enumerate organization names, descriptions, and avatar metadata through this list endpoint, while the single-organization endpoint returns `404` for the same organizations.


21) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-66874)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass required status checks and merge unverified code into a protected branch.

The vulnerability exists due to reliance on untrusted inputs in a security decision in the Actions workflow status check handling for pull requests when processing a fork pull request with a workflow definition from the pull request head that is excluded by its own filters. A remote user can define a workflow whose name matches a required status check context and configure a filter that never matches to bypass required status checks and merge unverified code into a protected branch.

No workflow run is created, so the fork approval gate does not apply.


22) Improper access control (CVE-ID: CVE-2026-66877)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code on self-hosted runners.

The vulnerability exists due to improper access control in the fork pull request workflow approval handling when processing job-level concurrency cancellation. A remote user can open a pull request and cause a pending run to be re-evaluated through a shared job-level concurrency group to execute arbitrary code on self-hosted runners.

User interaction is required because a maintainer must handle the pull request workflow process.


23) Improper access control (CVE-ID: CVE-2026-67577)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the activity feed and heatmap API endpoints when handling requests for limited-visibility user data. A remote user can send crafted API requests to disclose sensitive information.

Exposed data can include repository names, push and commit events, full commit-message content, issue and pull request events, and contribution timestamps for limited-visibility users with qualifying public-repository activity.


24) Improper access control (CVE-ID: CVE-2026-68957)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the issue-search API and web issue-search route when handling issue search requests for Limited-visibility users. A remote user can search for issues and read returned titles and bodies to disclose sensitive information.

Anonymous issue search does not return the same content.


25) Improper access control (CVE-ID: CVE-2026-68964)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the user SSH and GPG key API endpoints when handling requests for limited-visibility users. A remote user can send crafted API requests to disclose sensitive information.

The issue affects restricted accounts, which can access SSH public keys, GPG keys, fingerprints, and GPG-embedded email addresses of users whose profile visibility is set to Limited.


Remediation

Install update from vendor's website.

References