SB2026101918 - Multiple vulnerabilities in Gitea

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101918

SB2026101918 - Multiple vulnerabilities in Gitea

Published: October 19, 2026

Security Bulletin ID SB2026101918
CSH Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 10% Medium 30% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-96399)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service by crashing the Gitea instance.

The vulnerability exists due to an out-of-bounds read that triggers an uncaught runtime panic in the findActionKeywords function when rendering external issue tracker references. A remote user can modify a repository's external issue tracker settings and craft README content that triggers the panic when viewed to crash the Gitea instance.


2) Improper Enforcement of Behavioral Workflow (CVE-ID: CVE-2026-104626)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary workflow code on a self-hosted runner and compromise the confidentiality, integrity, and availability of its host and reachable resources.

The vulnerability exists due to improper enforcement of workflow state transitions in Gitea's ApproveRuns function when processing maintainer approval of cancelled fork pull request workflows. A remote user can submit a malicious workflow with a shared run-level concurrency group, cause a later run to cancel its approval-pending job, and induce a maintainer to approve the cancelled run, causing the job to become claimable by a matching runner and execute attacker-controlled workflow steps with the runner process's operating-system and network access.


3) Missing Authorization (CVE-ID: CVE-2026-103670)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cancel trusted CI runs and disrupt deployment workflows.

The vulnerability exists due to missing authorization checks in Gitea's run-level concurrency handling when inserting workflow runs for unapproved fork pull requests. A remote user can open a fork pull request whose workflow run shares a concurrency group with a trusted run to cancel that run when cancel-in-progress is enabled, potentially leaving deployments partially completed.


4) Unintended Proxy or Intermediary (CVE-ID: CVE-2026-94205)

CWE-ID: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass fork pull request workflow approval and execute arbitrary code on the base repository's self-hosted Actions runners.

The vulnerability exists due to a confused deputy flaw in Gitea Actions' ifNeedApprovalWith function when processing maintainer-triggered pull request sub-events: approval is determined using the event actor's permissions rather than the pull request author's trust status. A remote user can submit a fork pull request containing a malicious workflow and induce a maintainer to add a label, causing the fork-head workflow to execute on a registered self-hosted runner without explicit workflow approval.


5) Missing Authorization (CVE-ID: CVE-2026-104632)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code in a self-hosted Actions runner environment without workflow approval.

The vulnerability exists due to missing authorization checks in Gitea's Actions rerun handling in services/actions/rerun.go when recreating jobs for cancelled workflow runs that still require approval. A remote user can submit a fork pull request containing an attacker-controlled workflow and have an Actions writer cancel and rerun the blocked run to execute arbitrary code in the runner environment, because validateRerun accepts the cancelled run and execRerunPlan creates waiting jobs without checking NeedApproval.

The bypass concerns workflow dispatch, not the fork secrets policy.


6) Cross-site scripting (CVE-ID: CVE-2026-103667)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript on the Gitea origin and take over victim accounts, potentially gaining control of the entire instance if a site administrator is compromised.

The vulnerability exists due to improper validation of layer and config mediaType values in the Gitea container registry when processing image manifests and serving stored blobs with an attacker-controlled Content-Type. A remote user can publish a blob containing HTML and JavaScript with mediaType set to text/html and lure a victim into opening its URL and authenticating when prompted to execute the script on the Gitea origin, bypass same-origin request protections, and create a persistent, all-scope API token through /user/settings/applications.


7) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-103059)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass SSH authentication as a user with a registered RSA public key and obtain read/write access to all repositories accessible to that user.

The vulnerability exists due to case-insensitive comparison of RSA public-key text in Gitea's built-in SSH server when matching presented keys against registered keys using SQLite LIKE prefix queries. A remote attacker can retrieve a victim's public key from /{username}.keys, change the case of base64 letters in its RSA modulus until the resulting modulus is prime, and derive a working private exponent to authenticate with the resulting look-alike key and access or modify the victim's repositories.


8) Incorrect authorization (CVE-ID: CVE-2026-79960)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass protected-tag restrictions and disclose private repository contents by changing repository visibility.

The vulnerability exists due to incorrect authorization in Gitea's deploy-key identity assignment and hook pipeline when processing pushes authenticated with deploy keys. A remote user can use a writable deploy key to push with the repository owner's identity, creating protected tags without the required authorization or issuing git push -o repo.private=false against an empty private repository to make its contents public.


9) Least Privilege Violation (CVE-ID: CVE-2026-103504)

CWE-ID: CWE-272 - Least Privilege Violation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to retain write and administrative unit permissions on team-linked repositories, including private repositories, after the team's permissions are reduced through the API.

The vulnerability exists due to a least privilege violation in Gitea's EditTeam API handler and access-mode parsing when processing a team demotion request containing only the permission field. Existing per-unit permissions remain unchanged, while parsing "read" or "write" as None prevents the team's top-level permission from limiting effective access. A remote user can continue using the team's retained unit permissions to perform repository operations that the organization owner intended to revoke.


10) Resource exhaustion (CVE-ID: CVE-2026-96580)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to exhaust server memory and cause a denial of service affecting all tenants.

The vulnerability exists due to uncontrolled resource consumption in Gitea Actions static strategy.matrix expansion when creating workflow runs for fork pull requests. A remote user can open a pull request containing a workflow with a large static matrix to trigger uncapped Cartesian-product expansion before workflow approval, exhausting memory and causing the server process to be killed.

Exploitation requires Actions to be enabled, which is the default; no runner is needed.


Remediation

Install update from vendor's website.

References