jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

GHSA-5gvw-p9qm-jgwh CVE-2026-59889 MODERATE 7 days ago

## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by iterating its properties and ...

maven

No PRs yet

TypeORM: migration:generate template-literal code injection

GHSA-2rp8-mm9q-fp49 MODERATE 7 days ago

### Summary `typeorm migration:generate` embeds database schema metadata into JS/TS template literals, escaping backticks but not `${...}`. An att...

npm

No PRs yet

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

GHSA-r7wm-3cxj-wff9 HIGH 7 days ago

## Summary The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq](https://github.com/FasterXML/jackson-core/security/adv...

maven

No PRs yet

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

GHSA-gx3v-q759-g323 CVE-2026-20779 HIGH 7 days ago

### Summary I'm reporting **two related TOTP one-time-use defects** in Gitea that survive the CVE-2021-45331 fix. The 2018 fix (PR #3878) introduc...

go

No PRs yet

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

GHSA-fq2p-5p22-8g6j CVE-2026-58429 MODERATE 7 days ago

### Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permi...

go

No PRs yet

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

GHSA-2wm4-vwp6-v7xc CVE-2026-59765 MODERATE 7 days ago

### Summary Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, which validates resolved IPs...

go

No PRs yet

Gitea: Webhook Authorization Header Returned in Plaintext via API

GHSA-3r5c-2xxx-h872 CVE-2026-58511 LOW 7 days ago

## Summary The `ToHook()` function in `services/webhook/general.go` decrypts the webhook's `HeaderAuthorizationEncrypted` field and returns the pl...

go

No PRs yet

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

GHSA-frpw-3h2q-4jj6 CVE-2026-57897 MODERATE 7 days ago

**Author:** Prakhar Porwal **Date:** 2026-05-24 **Target:** Gitea (self-hosted Git service) **Branch tested:** `main` @ `b7e95cc48c` (development b...

go

No PRs yet

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

GHSA-q423-49rw-g9mh CVE-2026-58510 MODERATE 7 days ago

## Summary GHSA-8fwc-qjw5-rvgp ("Gitea may send release notification emails for private repositories to users whose access has been revoked", fix ...

go

No PRs yet

Gitea: Public-only API token restriction is not enforced on team API routes

GHSA-h56g-4qw7-2mxg CVE-2026-58431 MODERATE 7 days ago

### Summary Gitea's `/api/v1/teams/{id}` API routes do not correctly enforce the `public-only` access token restriction. A `public-only` token is...

go

No PRs yet

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

GHSA-prr9-9mp4-5gp2 CVE-2026-58427 MODERATE 7 days ago

## Summary PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members (not jus...

go

No PRs yet

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

GHSA-g9g6-qhrc-p3qc CVE-2026-58422 HIGH 7 days ago

### Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates thro...

go

No PRs yet

Gitea: Notification API leaks private issue metadata after access revocation

GHSA-44qc-pgvp-wx7v CVE-2026-58419 HIGH 7 days ago

# Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue acce...

go

No PRs yet

Gitea: Unauthorized Access to Labels of Private Organizations

GHSA-v73x-hx65-6pf4 CVE-2026-25038 HIGH 7 days ago

## Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpoints. A user without acces...

go

No PRs yet

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

GHSA-649p-mmhf-85c7 CVE-2026-27775 HIGH 7 days ago

## Vulnerability Header | Field | Value | | ----------...

go

No PRs yet

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

GHSA-wrf9-r3h7-7x5v CVE-2026-24451 HIGH 7 days ago

### Summary The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint continues to synchronize commits from a parent repository after the pa...

go

No PRs yet

Gitea: Two SSRF findings

GHSA-2fcr-jfvc-vgg2 CVE-2026-58314 HIGH 7 days ago

| --- | --- | | Versions tested | `gitea/gitea:1.26.2` (digest `sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031`); `gitea/g...

go

No PRs yet

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

GHSA-fw57-jgch-pgf3 CVE-2026-58436 HIGH 7 days ago

### Summary The Locale middleware that runs in front of every unauthenticated request calls `golang.org/x/text/language.ParseAcceptLanguage` on th...

go

No PRs yet

Gitea SSH Key Parser Denial of Service

GHSA-4xjf-493q-98p3 CVE-2026-56657 MODERATE 7 days ago

Gitea's SSH key ingestion endpoint accepts keys in RFC 4716 (SSH2) format and normalises them before storage. The normalisation function contains a...

go

No PRs yet

Gitea: Repository Visibility Manipulation via Git Push Options

GHSA-8p9h-49rc-qgxj CVE-2026-58437 HIGH 7 days ago

### Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | **Affected File** | `routers/private/hook_post_r...

go

No PRs yet

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

GHSA-vrhc-jjfc-m3m3 CVE-2026-55987 HIGH 7 days ago

## Description Gitea's OAuth2 sign-in callback reactivates a deactivated user account (`IsActive=false`) when the user signs in through an authent...

go

No PRs yet

Gitea LFS Deploy-Key Privilege Escalation

GHSA-rh79-75qm-gwjr CVE-2026-58435 MODERATE 7 days ago

## Vulnerability Header | Field | Value | | ------------------- | ------------...

go

No PRs yet

Gitea: Local File Inclusion via file:// URI in Migration Restore

GHSA-5ggr-2f2h-jmvm CVE-2026-58420 MODERATE 7 days ago

# Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/gitea_uploader.go, modules/uri/u...

go

No PRs yet

Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

GHSA-m932-crvm-gcp5 CVE-2026-55984 LOW 7 days ago

### Summary The AddTime API handler continues execution after an error returned by `GetUserByName()`. When a repository administrator specifies a...

go

No PRs yet

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

GHSA-mg4f-x9v4-6h2p CVE-2026-55982 MODERATE 7 days ago

### Summary The OIDC userinfo endpoint (`GET /login/oauth/userinfo`) accepts Gitea API tokens as bearer credentials but does not enforce API token...

go

No PRs yet

Gitea: Private Repository Metadata Remains Accessible After Access Revocation

GHSA-j2w3-9c3r-g83q CVE-2026-58434 LOW 7 days ago

### Summary A user who previously had access to a private repository can continue to obtain repository metadata through `GET /api/v1/user/starred`...

go

No PRs yet

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

GHSA-94v3-77j7-vm48 CVE-2026-54481 HIGH 7 days ago

Summary Gitea's internal API HTTP client (modules/private/internal.go) hardcodes TLSClientConfig.InsecureSkipVerify = true with no configuration o...

go

No PRs yet

Gitea: REST API exposes organization membership of private organizations to public

GHSA-jr5x-6h83-wrxf CVE-2026-58417 MODERATE 7 days ago

### Summary The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organizatio...

go

No PRs yet

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

GHSA-6cqf-375w-639g CVE-2026-50105 MODERATE 7 days ago

### Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform **no token-scope or public-only enforcement**. A personal acces...

go

No PRs yet

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

GHSA-fj8v-hjwv-qm88 CVE-2026-58416 MODERATE 7 days ago

### Summary `GetActionsUserRepoPermission` (`models/perm/access/repo_permission.go`) decides whether an Actions task token may access a target rep...

go

No PRs yet

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

GHSA-wwqq-x6w4-frm2 CVE-2026-42931 MODERATE 7 days ago

### Summary An unbounded `io.ReadAll(ctx.Req.Body)` call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea serve...

go

No PRs yet

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

GHSA-pgqf-926r-548m CVE-2026-58445 LOW 7 days ago

## Summary The API endpoint `DELETE /repos/{owner}/{repo}/issues/{index}/labels/{id}` loads the label by ID with a **global, unscoped** lookup and...

go

No PRs yet

Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

GHSA-cp3q-vrj2-ghhh CVE-2026-58444 MODERATE 7 days ago

### Summary A personal access token (PAT) or OAuth2 token that does **not** carry the `repository` scope or that is **public-only** is correctly re...

go

No PRs yet

Gitea: Public-only repository tokens can update private PR head branches

GHSA-xxjv-752h-3vp2 CVE-2026-58443 CRITICAL 7 days ago

### Summary Gitea allows a `public-only,write:repository` token to update a private pull request head branch through a public base repository route...

go

No PRs yet

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

GHSA-h2x6-g7q6-344v CVE-2026-58442 MODERATE 7 days ago

### Summary Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validatio...

go

No PRs yet

Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

GHSA-xmj7-xj85-hfc3 CVE-2026-58441 MODERATE 7 days ago

### Summary Gitea's `restore-repo` CLI command restores a repository from a dump directory/archive. When parsing `pull_request.yml` from that dump,...

go

No PRs yet

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

GHSA-xv9x-fj9g-vj6h CVE-2026-58438 LOW 7 days ago

### Details `RemoveDependency` in `routers/web/repo/issue_dependency.go` takes a `removeDependencyID` form parameter identifying the other issue by...

go

No PRs yet

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

GHSA-hg5r-vq93-9fv6 CVE-2026-58426 CRITICAL 7 days ago

### Summary Gitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context whil...

go

No PRs yet

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

GHSA-777r-4v59-6486 CVE-2026-58424 HIGH 7 days ago

| Field | Value | |-------|-------| | **Identifier (researcher-assigned)** | GITEA-2026-004 | | **Product** | Gitea (self-hosted Git service) | | *...

go

No PRs yet

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

GHSA-7wvc-rvp7-w99x CVE-2026-58423 HIGH 7 days ago

### Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instan...

go

No PRs yet

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

GHSA-v96j-25gv-g2w9 CVE-2026-58421 HIGH 7 days ago

This issue has been found by a security agent and review by myself. Gitea's CODEOWNERS feature uses the regexp2 library to match file paths agains...

go

No PRs yet

Gitea: SSRF via HTTP Redirect in Repository Migration

GHSA-rqhx-647v-wx32 CVE-2026-58418 MODERATE 7 days ago

## Summary Gitea 1.25.4 validates the initial URL provided to the repository migration endpoint (`POST /api/v1/repos/migrate`) and correctly block...

go

No PRs yet

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

GHSA-3pww-vcvm-3gmj CVE-2026-27761 MODERATE 7 days ago

### Summary A Gitea personal access token (PAT) restricted to a non-repository scope (e.g. `read:issue`) can read the commit history of any private...

go

No PRs yet

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

GHSA-2m9v-5q2g-58vq CVE-2026-28740 HIGH 7 days ago

## Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository wi...

go

No PRs yet

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

GHSA-f75j-4cw6-rmx4 CVE-2026-20896 CRITICAL 7 days ago

# Summary The Gitea Docker images ship an `app.ini` template that hard-codes: ``` REVERSE_PROXY_TRUSTED_PROXIES = * ``` The documented default f...

go

No PRs yet

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

GHSA-2r5c-gw76-rh3w CVE-2026-22874 CRITICAL 7 days ago

## Summary Gitea's default SSRF allow-list ([`MatchBuiltinExternal`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f03688...

go

No PRs yet

Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions

GHSA-rjvx-x5h2-6px5 MODERATE 7 days ago

### Summary The API endpoint used to fork repositories into organizations performs a weaker authorization check than the corresponding web UI and ...

go

No PRs yet

Gitea: Privilege Escalation via Access Token Scope Escalation in API

GHSA-683j-3ff6-hh2x CVE-2026-56654 HIGH 7 days ago

Gitea's API endpoint for creating Personal Access Tokens (`POST /users/{username}/tokens`) is protected by a middleware (`reqBasicOrRevProxyAuth`) ...

go

No PRs yet

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

GHSA-6hm7-3pwj-22rm CVE-2026-56755 HIGH 7 days ago

Gitea's Debian package registry parser contains an unbounded decompression vulnerability in [ParseControlFile](https://github.com/go-gitea/gitea/bl...

go

No PRs yet

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

GHSA-p4mj-98mv-xq26 CVE-2026-58507 MODERATE 7 days ago

| Field | Value | |-------|-------| | **Affected File** | `routers/web/repo/githttp.go`, `services/context/repo.go` | | **Affected Functions** | `h...

go

No PRs yet