Вход
Все бюллетени/sisyphus_loongarch64/ALT-PU-2026-14548-1
ALT-PU-2026-14548-1

Обновление пакета gitea в ветке sisyphus_loongarch64

Версия1.27.2-alt1
Задание#0
Опубликовано2026-08-27
Макс. серьёзностьCRITICAL
Серьёзность:

Закрытые проблемы (132)

BDU:2026-09234
CRITICAL9.6

Уязвимость метода HostMatchList.checkIP системы управления Git-репозиториями Gitea, позволяющая нарушителю осуществить SSRF-атаку

Опубликовано: 2026-07-05
CVSS 3.xКРИТИЧЕСКАЯ 9.6
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS 2.0ВЫСОКАЯ 8.5
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:N
Ссылки
BDU:2026-09304
CRITICAL9.8

Уязвимость конфигурации Docker-образа системы управления Git-репозиториями Gitea, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Опубликовано: 2026-07-06
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0КРИТИЧЕСКАЯ 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
Ссылки
BDU:2026-10703
CRITICAL9.8

Уязвимость файла services/repository/files/patch.go системы управления Git-репозиториями Gitea, позволяющая нарушителю выполнить произвольный код и получить несанкционированный доступ к защищаемой информации

Опубликовано: 2026-07-29Изменено: 2026-10-07
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0КРИТИЧЕСКАЯ 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
Ссылки
BDU:2026-12010
HIGH7.5

Уязвимость компонента POST /api/v1/repos/{owner}/{repo}/merge-upstream системы управления Git-репозиториями Gitea, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Опубликовано: 2026-08-20
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N
Ссылки
BDU:2026-12013
MEDIUM4.3

Уязвимость системы управления Git-репозиториями Gitea, связанная с недостатками механизма авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Опубликовано: 2026-08-20
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0СРЕДНЯЯ 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
Ссылки
CVE-2026-20779
HIGH7.1

Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.

Опубликовано: 2026-07-03Изменено: 2026-07-07
CVSS 3.xВЫСОКАЯ 7.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Ссылки
CVE-2026-20896
CRITICAL9.8

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

Опубликовано: 2026-07-03Изменено: 2026-07-07
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2026-22874
CRITICAL9.6

Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

Опубликовано: 2026-07-03Изменено: 2026-07-07
CVSS 3.xКРИТИЧЕСКАЯ 9.6
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Ссылки
CVE-2026-23603
LOW3.1

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xНИЗКАЯ 3.1
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2026-24451
HIGH7.5

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

Опубликовано: 2026-07-03Изменено: 2026-07-07
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2026-25038
HIGH7.5

Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

Опубликовано: 2026-07-03Изменено: 2026-07-07
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2026-25946
MEDIUM5.3

When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker.

Опубликовано: 2026-10-14Изменено: 2026-10-14
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2026-27761
MEDIUM4.3

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope.

Опубликовано: 2026-07-03Изменено: 2026-07-07
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2026-27775
HIGH8.8

Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

Опубликовано: 2026-07-03Изменено: 2026-07-06
CVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2026-28740
HIGH7.1

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

Опубликовано: 2026-07-03Изменено: 2026-07-07
CVSS 3.xВЫСОКАЯ 7.1
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Ссылки
CVE-2026-50105
MEDIUM4.3

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2026-54481
HIGH7.5

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2026-55982
CRITICAL9.1

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xКРИТИЧЕСКАЯ 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Ссылки
CVE-2026-55984
LOW2.7

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xНИЗКАЯ 2.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Ссылки
CVE-2026-55986
MEDIUM5.4

Email Management API Bypasses ManageCredentials Feature Restrictions

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Ссылки
CVE-2026-55987
HIGH8.1

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xВЫСОКАЯ 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Ссылки
CVE-2026-56443
CRITICAL9.6

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xКРИТИЧЕСКАЯ 9.6
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Ссылки
CVE-2026-56654
CRITICAL9.8

Privilege Escalation via Access Token Scope Escalation in API

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2026-57894
HIGH8.5

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xВЫСОКАЯ 8.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Ссылки
CVE-2026-58417
HIGH7.5

REST API exposes organization membership of private organizations to public

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2026-58418
MEDIUM6.5

SSRF via HTTP Redirect in Repository Migration

Опубликовано: 2026-07-03Изменено: 2026-07-06
CVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2026-58419
HIGH7.5

Notification API leaks private issue metadata after access revocation

Опубликовано: 2026-07-03Изменено: 2026-07-06
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2026-58421
HIGH7.5

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Опубликовано: 2026-07-03Изменено: 2026-07-06
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
CVE-2026-58422
CRITICAL9.8

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Опубликовано: 2026-07-03Изменено: 2026-07-06
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2026-58423
HIGH7.7

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Опубликовано: 2026-07-03Изменено: 2026-07-06
CVSS 3.xВЫСОКАЯ 7.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Ссылки
CVE-2026-58424
HIGH8.9

Permanent Fork PR Workflow Approval Gate Bypass

Опубликовано: 2026-07-03Изменено: 2026-07-06
CVSS 3.xВЫСОКАЯ 8.9
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H
Ссылки
CVE-2026-58425
MEDIUM4.3

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2026-58428
MEDIUM6.5

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Ссылки
CVE-2026-58429
MEDIUM4.9

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 4.9
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2026-58431
MEDIUM4.3

Public-only API token restriction is not enforced on team API routes

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2026-58432
MEDIUM5.9

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2026-58433
CRITICAL9.1

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xКРИТИЧЕСКАЯ 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Ссылки
CVE-2026-58434
HIGH7.5

Private Repository Metadata Remains Accessible After Access Revocation

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2026-58436
HIGH7.5

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
CVE-2026-58438
HIGH7.5

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2026-58439
HIGH8.1

Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xВЫСОКАЯ 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Ссылки
CVE-2026-58440
MEDIUM6.8

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 6.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Ссылки
CVE-2026-58441
MEDIUM6.3

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 6.3
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Ссылки
CVE-2026-58442
MEDIUM6.5

Repository migration SSRF via multi-answer DNS allow-list bypass

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2026-58443
CRITICAL9.1

Public-only repository tokens can update private PR head branches

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xКРИТИЧЕСКАЯ 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Ссылки
CVE-2026-58444
MEDIUM4.3

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2026-58445
LOW2.7

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xНИЗКАЯ 2.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2026-58507
MEDIUM5.3

Private Repository Existence Disclosure via go-get Meta Endpoint

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2026-58510
MEDIUM4.3

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2026-59763
MEDIUM4.3

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Ссылки
CVE-2026-59765
HIGH7.5

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Опубликовано: 2026-08-13Изменено: 2026-08-26
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2026-59766
MEDIUM4.3

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.

Опубликовано: 2026-10-14Изменено: 2026-10-14
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки
CVE-2026-59774
CRITICAL9.8

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.

Опубликовано: 2026-10-14Изменено: 2026-10-15
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2026-60004
CRITICAL9.8

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Опубликовано: 2026-08-26Изменено: 2026-08-27
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2026-60008
LOW3.5

Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.

Опубликовано: 2026-10-14Изменено: 2026-10-14
CVSS 3.xНИЗКАЯ 3.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Ссылки
CVE-2026-73278
CRITICAL9.8

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.

Опубликовано: 2026-10-06Изменено: 2026-10-13
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2026-73535
NONE

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.

Опубликовано: 2026-10-14Изменено: 2026-10-14
Ссылки
CVE-2026-73539
NONE

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.

Опубликовано: 2026-10-14Изменено: 2026-10-14
Ссылки
CVE-2026-73800
NONE

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.

Опубликовано: 2026-10-14Изменено: 2026-10-14
Ссылки
CVE-2026-73804
NONE

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.

Опубликовано: 2026-10-14Изменено: 2026-10-14
Ссылки
CVE-2026-73814
NONE

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.

Опубликовано: 2026-10-14Изменено: 2026-10-14
Ссылки
GHSA-25gq-j9jx-43pg
MEDIUM6.5

Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Опубликовано: 2026-07-21
CVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Ссылки
GHSA-2fcr-jfvc-vgg2
HIGH7.7

Gitea: Two SSRF findings

Опубликовано: 2026-07-21Изменено: 2026-09-24
CVSS 3.xВЫСОКАЯ 7.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Ссылки
GHSA-2m9v-5q2g-58vq
HIGH7.1

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Опубликовано: 2026-07-21
CVSS 3.xВЫСОКАЯ 7.1
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Ссылки
GHSA-2r5c-gw76-rh3w
CRITICAL9.6

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Опубликовано: 2026-07-21
CVSS 3.xКРИТИЧЕСКАЯ 9.6
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Ссылки
GHSA-2wm4-vwp6-v7xc
MEDIUM6.9

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Опубликовано: 2026-07-21Изменено: 2026-09-24
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 4.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Ссылки
GHSA-3pww-vcvm-3gmj
MEDIUM4.3

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Опубликовано: 2026-07-21
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки
GHSA-44qc-pgvp-wx7v
HIGH7.5

Gitea: Notification API leaks private issue metadata after access revocation

Опубликовано: 2026-07-21
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
GHSA-4xjf-493q-98p3
MEDIUM6.9

Gitea SSH Key Parser Denial of Service

Опубликовано: 2026-07-21Изменено: 2026-09-24
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 4.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Ссылки
GHSA-649p-mmhf-85c7
HIGH8.8

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Опубликовано: 2026-07-21
CVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Ссылки
GHSA-66m4-5jjr-2rg5
MEDIUM6.8

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Опубликовано: 2026-07-21
CVSS 3.xСРЕДНЯЯ 6.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Ссылки
GHSA-683j-3ff6-hh2x
HIGH8.7

Gitea: Privilege Escalation via Access Token Scope Escalation in API

Опубликовано: 2026-07-21Изменено: 2026-07-21
CVSS 4.0ВЫСОКАЯ 8.7
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Ссылки
GHSA-6c6r-5xr4-cr5m
MEDIUM5.9

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Опубликовано: 2026-07-21
CVSS 3.xСРЕДНЯЯ 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Ссылки
GHSA-6hm7-3pwj-22rm
HIGH7.1

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Опубликовано: 2026-07-21
CVSS 4.0ВЫСОКАЯ 7.1
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Ссылки
GHSA-777r-4v59-6486
HIGH8.9

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Опубликовано: 2026-07-21
CVSS 3.xВЫСОКАЯ 8.9
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H
Ссылки
GHSA-7p4h-3gxq-x3h3
MEDIUM4.3

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Опубликовано: 2026-07-21Изменено: 2026-09-24
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки
GHSA-7wvc-rvp7-w99x
HIGH7.7

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Опубликовано: 2026-07-21Изменено: 2026-07-21
CVSS 3.xВЫСОКАЯ 7.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Ссылки
GHSA-82f7-87hm-852x
HIGH8.5

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Опубликовано: 2026-07-21Изменено: 2026-07-21
CVSS 3.xВЫСОКАЯ 8.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Ссылки
GHSA-9mq6-mqjj-c2c5
MEDIUM5.3

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Опубликовано: 2026-07-21
CVSS 4.0СРЕДНЯЯ 5.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Ссылки
GHSA-f75j-4cw6-rmx4
CRITICAL9.8

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Опубликовано: 2026-07-21
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки
GHSA-fj8v-hjwv-qm88
MEDIUM6.3

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Опубликовано: 2026-07-21
CVSS 3.xСРЕДНЯЯ 6.3
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Ссылки
GHSA-fq2p-5p22-8g6j
MEDIUM4.9

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Опубликовано: 2026-07-21
CVSS 3.xСРЕДНЯЯ 4.9
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Ссылки
GHSA-fw57-jgch-pgf3
HIGH8.7

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Опубликовано: 2026-07-21
CVSS 4.0ВЫСОКАЯ 8.7
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Ссылки
GHSA-g9g6-qhrc-p3qc
HIGH7.6

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Опубликовано: 2026-07-21
CVSS 4.0ВЫСОКАЯ 7.6
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Ссылки
GHSA-gx3v-q759-g323
HIGH7.1

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Опубликовано: 2026-07-21
CVSS 3.xВЫСОКАЯ 7.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Ссылки
GHSA-j2w3-9c3r-g83q
LOW2.3

Gitea: Private Repository Metadata Remains Accessible After Access Revocation

Опубликовано: 2026-07-21
CVSS 4.0НИЗКАЯ 2.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Ссылки
GHSA-jr5x-6h83-wrxf
MEDIUM5.3

Gitea: REST API exposes organization membership of private organizations to public

Опубликовано: 2026-07-21
CVSS 4.0СРЕДНЯЯ 5.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Ссылки
GHSA-q9pg-jj6x-j9p6
MEDIUM5.9

Gitea: draft release attachment disclosure via missing web authorization

Опубликовано: 2026-07-21
CVSS 3.xСРЕДНЯЯ 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
GHSA-qf2f-qh6p-7v89
MEDIUM4.3

Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

Опубликовано: 2026-07-21
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки
GHSA-rgv6-xp99-6mgj
CRITICAL9.1

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Опубликовано: 2026-07-21
CVSS 4.0КРИТИЧЕСКАЯ 9.1
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Ссылки
GHSA-rqhx-647v-wx32
MEDIUM6.5

Gitea: SSRF via HTTP Redirect in Repository Migration

Опубликовано: 2026-07-21
CVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Ссылки
GHSA-v73x-hx65-6pf4
HIGH7.5

Gitea: Unauthorized Access to Labels of Private Organizations

Опубликовано: 2026-07-21Изменено: 2026-07-21
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
GHSA-v96j-25gv-g2w9
HIGH7.5

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Опубликовано: 2026-07-21
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
GHSA-vxv2-8j6r-pcpg
MEDIUM4.3

Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Опубликовано: 2026-07-21
CVSS 3.xСРЕДНЯЯ 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки
GHSA-w5pg-649r-p6gg
HIGH8.1

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Опубликовано: 2026-07-21Изменено: 2026-07-21
CVSS 3.xВЫСОКАЯ 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Ссылки
GHSA-wrf9-r3h7-7x5v
HIGH7.5

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Опубликовано: 2026-07-21
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
GHSA-x77v-q46j-393g
LOW3.1

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Опубликовано: 2026-07-21
CVSS 3.xНИЗКАЯ 3.1
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Ссылки