Executive brief
Improper Access Control in Gitea
Affected products
- Go github.com/go-gitea/gitea
Junglewise Threat Intelligence
CVE-2020-28991: Improper Access Control in Gitea
CVE-2020-28991 · Severity: low · CVSS 3.1 · Published 2024-04-24
Technologies: github.com/go-gitea/gitea (Go). Vendors: Go.
Related threats
- Gitea open redirect via backslash-encoded paths in redirect_to parameter
- GO-2026-4362 - Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea
- GO-2026-4369 - Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea
- GO-2026-4368 - Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea
- GO-2026-4366 - Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea