Approved changes feed: RSS · Atom
cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*
part: a version: * update: *
| Vendor | Gitea (eaa7e9b8-383b-5ece-9dae-e8930725e404) |
|---|---|
| Product | Gitea (29e2eaf1-5af6-5b23-bb58-ef576da9062f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | - |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-20912 |
vulnerable | 2026-06-08 07:49:13.403669 |
Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
Published: 2026-01-22T22:01:52.026Z
Updated: 2026-07-15T01:20:07.394Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-20904 |
vulnerable | 2026-06-08 07:49:13.401903 |
Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.
Published: 2026-01-22T22:01:51.762Z
Updated: 2026-01-23T21:53:53.397Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-20897 |
vulnerable | 2026-06-08 07:49:13.396284 |
Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
Published: 2026-01-22T22:01:51.508Z
Updated: 2026-07-15T01:20:11.688Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-20888 |
vulnerable | 2026-06-08 07:49:13.389018 |
Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users.
Published: 2026-01-22T22:01:51.214Z
Updated: 2026-01-23T21:54:14.856Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-20883 |
vulnerable | 2026-06-08 07:49:13.384513 |
Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure
Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.
Published: 2026-01-22T22:01:50.840Z
Updated: 2026-01-23T21:54:21.705Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-20800 |
vulnerable | 2026-06-08 07:49:12.630562 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-20750 |
vulnerable | 2026-06-08 07:49:12.525363 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-20736 |
vulnerable | 2026-06-08 07:49:12.513133 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0798 |
vulnerable | 2026-06-08 07:47:13.210407 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-69413 |
vulnerable | 2026-06-08 07:43:13.590395 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68945 |
vulnerable | 2026-06-08 07:41:21.963998 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68944 |
vulnerable | 2026-06-08 07:41:21.963748 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68943 |
vulnerable | 2026-06-08 07:41:21.963492 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68942 |
vulnerable | 2026-06-08 07:41:21.963233 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68941 |
vulnerable | 2026-06-08 07:41:21.962892 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68940 |
vulnerable | 2026-06-08 07:41:21.962469 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68939 |
vulnerable | 2026-06-08 07:41:21.961964 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.