Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
CVSS Score
8.2
EPSS Score
0.0
Published
2025-12-26
In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.
CVSS Score
3.1
EPSS Score
0.0
Published
2025-12-26
Gitea before 1.25.2 mishandles authorization for deletion of releases.
CVSS Score
4.3
EPSS Score
0.0
Published
2025-12-26
Page 2