In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
CVSS Score
5.4
EPSS Score
0.003
Published
2025-12-26
Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.
CVSS Score
5.3
EPSS Score
0.004
Published
2025-12-26
In Gitea before 1.21.2, an anonymous user can visit a private user's project.
CVSS Score
5.8
EPSS Score
0.004
Published
2025-12-26
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
CVSS Score
8.2
EPSS Score
0.004
Published
2025-12-26
In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.
CVSS Score
3.1
EPSS Score
0.003
Published
2025-12-26
Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.
CVSS Score
4.9
EPSS Score
0.002
Published
2025-12-26
Gitea before 1.25.2 mishandles authorization for deletion of releases.
CVSS Score
4.3
EPSS Score
0.004
Published
2025-12-26
In Gitea through 1.17.1, repo cloning can occur in the migration function.
CVSS Score
6.5
EPSS Score
0.006
Published
2023-08-07
Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.
CVSS Score
3.0
EPSS Score
0.005
Published
2023-07-05
Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.
CVSS Score
9.8
EPSS Score
0.012
Published
2022-10-16