SB2026101919 - Multiple vulnerabilities in Gitea

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101919

SB2026101919 - Multiple vulnerabilities in Gitea

Published: October 19, 2026

Security Bulletin ID SB2026101919
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 14% Low 86%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-105268)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete or rename other users' comment attachments on issues they opened.

The vulnerability exists due to improper authorization in Gitea's attachmentBelongsToRepoOrIssue function when validating attachments for issue-scoped API requests without checking CommentID. A remote user can supply the identifier of another user's comment attachment to an issue-scoped attachment route to delete or rename that attachment on an issue they opened.

Renaming changes only the attachment filename, not its contents.


2) Incorrect authorization (CVE-ID: CVE-2026-105267)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to permanently delete published releases and their attachments without release-write permission.

The vulnerability exists due to incorrect authorization in the Gitea POST /{owner}/{repo}/tags/delete endpoint when processing deletion requests without distinguishing bare tags from full releases. A remote user can submit a deletion request targeting a release with only Code:Write permission to delete the release record and its attachments from the database and blob storage.

Deletion is restricted to releases in the targeted repository.


3) Incorrect authorization (CVE-ID: CVE-2026-89182)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass the server's private-repository policy and make their own repository and its contents publicly accessible.

The vulnerability exists due to incorrect authorization in Gitea's hookPostReceiveUpdateRepoByOptions function when processing push options on the first push to an empty repository. A remote user can submit git push -o repo.private=false to a repository they administer to change its visibility to public without enforcement of the server-level visibility policy.

Only instances configured with FORCE_PRIVATE = true are affected; this setting is disabled by default.


4) Incorrect authorization (CVE-ID: CVE-2026-97208)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass the site-wide prohibition on new push mirrors and establish persistent, automatic exfiltration of repository contents to a controlled remote.

The vulnerability exists due to incorrect authorization in Gitea's AddPushMirror API handler when processing push-mirror creation requests without enforcing setting.Mirror.DisableNewPush. A remote user can use repository-administrator rights and a Repository-scoped token to create an outbound push mirror through the API despite DISABLE_NEW_PUSH being enabled, causing the entire repository, including all refs, to be automatically force-pushed to a controlled remote.


5) Improper Authentication (CVE-ID: CVE-2026-101023)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to extend access beyond a captured OAuth access token's original lifetime.

The vulnerability exists due to missing token-kind validation in Gitea's OAuth refresh-token endpoint when processing token refresh requests. A remote user can submit an unexpired access token for the same client and grant as a refresh token to obtain new access and refresh tokens, extending access beyond the original token's lifetime.


6) Infinite loop (CVE-ID: CVE-2026-104633)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service by exhausting server memory.

The vulnerability exists due to an unreachable loop exit condition in the Gitea migration downloader in services/migrations/gitea_downloader.go when processing pagination settings supplied by a migration source. A remote user can initiate a repository migration from a controlled source that reports max_response_items: 0 to make paginated fetch loops run indefinitely and accumulate results in memory, exhausting server resources.


7) Incorrect authorization (CVE-ID: CVE-2026-86684)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write controlled Git refs and repository content to a local Git repository outside the intended authorization boundary and infer whether candidate local paths pass directory validation.

The vulnerability exists due to incorrect authorization in Gitea's push-mirror API when checking local-path permissions against the repository owner instead of the caller. A remote user can use repository-admin access to submit an absolute file:// path through the remote_address parameter of POST /api/v1/repos/{owner}/{repo}/push_mirrors and trigger synchronization to write controlled Git content to a target repository writable by the Gitea process; differing validation responses can also reveal limited information about local directory existence.


Remediation

Install update from vendor's website.

References