# code.gitea.io/gitea (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/code-gitea-io-gitea Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/code-gitea-io-gitea.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 126 vulnerabilities in code.gitea.io/gitea (Go): 0 in the last 7 days and 2 in the last 90 days, 15 of them critical and 1 exploited in the wild. The most recent, CVE-2026-59766, was published on 14 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 2 - All time: 126 (15 critical, 1 exploited in the wild) ## About code.gitea.io/gitea (Go) Gitea is a lightweight self-hosted Git service written in Go. ## Latest code.gitea.io/gitea (Go) vulnerabilities - [CVE-2026-59766: Gitea incorrect authorization in starred repos and tracked times API](https://junglewise.ai/threats/cve-2026-59766-gitea-incorrect-authorization-in-starred-repos-and-tracked-times) (medium, CVSS 4.3, published 14 Oct 2026) - [CVE-2026-60004: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.](https://junglewise.ai/threats/cve-2026-60004-gitea-code-injection-in-diffpatch-api) (critical, exploited in the wild, CVSS 9.8, published 26 Aug 2026) - [CVE-2026-59765: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata](https://junglewise.ai/threats/cve-2026-59765-gitea-ssrf-and-local-file-read-via-migration-asset-bypass) (high, CVSS 7.5, published 13 Aug 2026) - [CVE-2026-59763: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads](https://junglewise.ai/threats/cve-2026-59763-gitea-resource-amplification-in-arch-package-metadata-parsing) (medium, CVSS 4.3, published 13 Aug 2026) - [CVE-2026-34966: Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata](https://junglewise.ai/threats/cve-2026-34966-gitea-ssrf-via-migration-asset-downloads-bypasses-hostmatcher) (high, CVSS 7.6, published 5 Aug 2026) - [GO-2026-6074 - Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation…](https://junglewise.ai/threats/go-2026-6074-gitea-api-fork-endpoint-authorization-bypass-allows-a93de534) (info, published 27 Jul 2026) - [CVE-2026-58429: Gitea public-only token scope bypass in Organization and Permission endpoints](https://junglewise.ai/threats/cve-2026-58429-gitea-public-only-token-scope-bypass-in-organization-and) (medium, CVSS 4.9, published 21 Jul 2026) - [CVE-2026-58511: Gitea plaintext webhook authorization header exposure in API](https://junglewise.ai/threats/cve-2026-58511-gitea-plaintext-webhook-authorization-header-exposure-in-api) (low, CVSS 3.1, published 21 Jul 2026) - [CVE-2026-57897: Gitea information disclosure in organization Actions API](https://junglewise.ai/threats/cve-2026-57897-gitea-information-disclosure-in-organization-actions-api) (medium, CVSS 6.5, published 21 Jul 2026) - [CVE-2026-58510: Gitea information disclosure via stale watches in REST API](https://junglewise.ai/threats/cve-2026-58510-gitea-information-disclosure-via-stale-watches-in-rest-api) (medium, CVSS 4.3, published 21 Jul 2026) - [CVE-2026-58314: Gitea SSRF in webhooks and OpenID discovery](https://junglewise.ai/threats/cve-2026-58314-gitea-ssrf-in-webhooks-and-openid-discovery) (high, CVSS 7.7, published 21 Jul 2026) - [CVE-2026-58436: Gitea quadratic-time DoS in Locale middleware via Accept-Language header](https://junglewise.ai/threats/cve-2026-58436-gitea-quadratic-time-dos-in-locale-middleware-via-accept-language) (high, CVSS 4, published 21 Jul 2026) - [CVE-2026-56657: Gitea SSH key parser denial of service in normalization loop](https://junglewise.ai/threats/cve-2026-56657-gitea-ssh-key-parser-denial-of-service-in-normalization-loop) (medium, CVSS 3.1, published 21 Jul 2026) - [CVE-2026-58437: Gitea repository visibility manipulation via Git push options](https://junglewise.ai/threats/cve-2026-58437-gitea-repository-visibility-manipulation-via-git-push-options) (high, CVSS 7.1, published 21 Jul 2026) - [CVE-2026-55987: Gitea account deactivation bypass via OAuth2 sign-in](https://junglewise.ai/threats/cve-2026-55987-gitea-account-deactivation-bypass-via-oauth2-sign-in) (high, CVSS 8.1, published 21 Jul 2026) - [CVE-2026-58435: Gitea LFS privilege escalation via deploy key impersonation](https://junglewise.ai/threats/cve-2026-58435-gitea-lfs-privilege-escalation-via-deploy-key-impersonation) (medium, CVSS 5.4, published 21 Jul 2026) - [CVE-2026-55984: Gitea NULL pointer dereference in AddTime API](https://junglewise.ai/threats/cve-2026-55984-gitea-null-pointer-dereference-in-addtime-api) (low, CVSS 3.1, published 21 Jul 2026) - [CVE-2026-55982: Gitea OIDC userinfo scope bypass allows identity disclosure](https://junglewise.ai/threats/cve-2026-55982-gitea-oidc-userinfo-scope-bypass-allows-identity-disclosure) (medium, CVSS 4, published 21 Jul 2026) - [CVE-2026-58434: Gitea information disclosure via starred repository metadata after access revocation](https://junglewise.ai/threats/cve-2026-58434-gitea-information-disclosure-via-starred-repository-metadata) (medium, CVSS 4, published 21 Jul 2026) - [CVE-2026-54481: Gitea improper certificate validation in internal API client](https://junglewise.ai/threats/cve-2026-54481-gitea-improper-certificate-validation-in-internal-api-client) (high, CVSS 7.5, published 21 Jul 2026) - [CVE-2026-50105: Gitea authorization bypass in RSS and Atom feed handlers](https://junglewise.ai/threats/cve-2026-50105-gitea-authorization-bypass-in-rss-and-atom-feed-handlers) (medium, CVSS 4.3, published 21 Jul 2026) - [CVE-2026-42931: Gitea denial of service via unbounded memory allocation in NPM API](https://junglewise.ai/threats/cve-2026-42931-gitea-denial-of-service-via-unbounded-memory-allocation-in-npm) (medium, CVSS 6.5, published 21 Jul 2026) - [CVE-2026-58445: Gitea cross-repository label enumeration oracle in DeleteIssueLabel API](https://junglewise.ai/threats/cve-2026-58445-gitea-cross-repository-label-enumeration-oracle-in) (low, CVSS 3.1, published 21 Jul 2026) - [CVE-2026-58444: Gitea token scope bypass in repository home page](https://junglewise.ai/threats/cve-2026-58444-gitea-token-scope-bypass-in-repository-home-page) (medium, CVSS 4.3, published 21 Jul 2026) - [CVE-2026-58443: Gitea public-only token scope bypass in pull request updates](https://junglewise.ai/threats/cve-2026-58443-gitea-public-only-token-scope-bypass-in-pull-request-updates) (critical, CVSS 9.6, published 21 Jul 2026) ## Most severe code.gitea.io/gitea (Go) vulnerabilities - [CVE-2026-60004: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.](https://junglewise.ai/threats/cve-2026-60004-gitea-code-injection-in-diffpatch-api) (critical, exploited in the wild, CVSS 9.8, published 26 Aug 2026) - [CVE-2026-20896: Gitea Docker image authentication bypass via trusted proxy misconfiguration](https://junglewise.ai/threats/cve-2026-20896-gitea-docker-image-authentication-bypass-via-trusted-proxy) (critical, CVSS 9.8, published 3 Jul 2026) - [CVE-2026-26292: Gitea migration transport bypass in LFS mirror operations](https://junglewise.ai/threats/cve-2026-26292-gitea-migration-transport-bypass-in-lfs-mirror-operations) (critical, CVSS 9.8, published 3 Jul 2026) - [CVE-2026-27780: Gitea branch protection bypass via bufio.Scanner error handling in pre-receive hooks](https://junglewise.ai/threats/cve-2026-27780-gitea-branch-protection-bypass-via-bufio-scanner-error-handling) (critical, CVSS 9.8, published 3 Jul 2026) - [CVE-2026-58443: Gitea public-only token scope bypass in pull request updates](https://junglewise.ai/threats/cve-2026-58443-gitea-public-only-token-scope-bypass-in-pull-request-updates) (critical, CVSS 9.6, published 21 Jul 2026) - [CVE-2026-22874: Gitea SSRF via incomplete hostmatcher allow-list filtering](https://junglewise.ai/threats/cve-2026-22874-gitea-ssrf-via-incomplete-hostmatcher-allow-list-filtering) (critical, CVSS 9.6, published 3 Jul 2026) - [CVE-2026-58426: Gitea Actions HMAC ambiguity in Artifacts V4 signed URLs](https://junglewise.ai/threats/cve-2026-58426-gitea-actions-hmac-ambiguity-in-artifacts-v4-signed-urls) (critical, CVSS 9.6, published 3 Jul 2026) - [CVE-2026-25718: Gitea improper link resolution in template repository generation](https://junglewise.ai/threats/cve-2026-25718-gitea-improper-link-resolution-in-template-repository-generation) (critical, CVSS 9.1, published 3 Jul 2026) - [CVE-2026-22547: Gitea improper input validation in repository creation fields](https://junglewise.ai/threats/cve-2026-22547-gitea-improper-input-validation-in-repository-creation-fields) (critical, CVSS 9.1, published 3 Jul 2026) - [CVE-2026-26247: Gitea OAuth2 PKCE S256 verifier bypass](https://junglewise.ai/threats/cve-2026-26247-gitea-oauth2-pkce-s256-verifier-bypass) (critical, CVSS 9.1, published 3 Jul 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 1 | 1 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities - [github.com/traefik/traefik/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v3): 70 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "code.gitea.io/gitea (Go) vulnerabilities", https://junglewise.ai/threats/technologies/code-gitea-io-gitea, 13 November 2026.