# gitea.dev (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/gitea-dev Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/gitea-dev.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 44 vulnerabilities in gitea.dev (Go): 0 in the last 7 days and 2 in the last 90 days, 3 of them critical and 1 exploited in the wild. The most recent, CVE-2026-59766, was published on 14 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 2 - All time: 44 (3 critical, 1 exploited in the wild) ## About gitea.dev (Go) A self-hosted Git service written in Go. ## Latest gitea.dev (Go) vulnerabilities - [CVE-2026-59766: Gitea incorrect authorization in starred repos and tracked times API](https://junglewise.ai/threats/cve-2026-59766-gitea-incorrect-authorization-in-starred-repos-and-tracked-times) (medium, CVSS 4.3, published 14 Oct 2026) - [CVE-2026-60004: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.](https://junglewise.ai/threats/cve-2026-60004-gitea-code-injection-in-diffpatch-api) (critical, exploited in the wild, CVSS 9.8, published 26 Aug 2026) - [CVE-2026-59763: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads](https://junglewise.ai/threats/cve-2026-59763-gitea-resource-amplification-in-arch-package-metadata-parsing) (medium, CVSS 4.3, published 13 Aug 2026) - [CVE-2026-34966: Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata](https://junglewise.ai/threats/cve-2026-34966-gitea-ssrf-via-migration-asset-downloads-bypasses-hostmatcher) (high, CVSS 7.6, published 5 Aug 2026) - [CVE-2026-58429: Gitea public-only token scope bypass in Organization and Permission endpoints](https://junglewise.ai/threats/cve-2026-58429-gitea-public-only-token-scope-bypass-in-organization-and) (medium, CVSS 4.9, published 21 Jul 2026) - [CVE-2026-58511: Gitea plaintext webhook authorization header exposure in API](https://junglewise.ai/threats/cve-2026-58511-gitea-plaintext-webhook-authorization-header-exposure-in-api) (low, CVSS 3.1, published 21 Jul 2026) - [CVE-2026-57897: Gitea information disclosure in organization Actions API](https://junglewise.ai/threats/cve-2026-57897-gitea-information-disclosure-in-organization-actions-api) (medium, CVSS 6.5, published 21 Jul 2026) - [CVE-2026-58510: Gitea information disclosure via stale watches in REST API](https://junglewise.ai/threats/cve-2026-58510-gitea-information-disclosure-via-stale-watches-in-rest-api) (medium, CVSS 4.3, published 21 Jul 2026) - [CVE-2026-58431: Gitea incorrect authorization for public-only tokens in team API routes](https://junglewise.ai/threats/cve-2026-58431-gitea-incorrect-authorization-for-public-only-tokens-in-team-api) (medium, CVSS 4.3, published 21 Jul 2026) - [CVE-2026-58427: Gitea information disclosure in private organization member list](https://junglewise.ai/threats/cve-2026-58427-gitea-information-disclosure-in-private-organization-member-list) (medium, CVSS 5.3, published 21 Jul 2026) - [CVE-2026-58314: Gitea SSRF in webhooks and OpenID discovery](https://junglewise.ai/threats/cve-2026-58314-gitea-ssrf-in-webhooks-and-openid-discovery) (high, CVSS 7.7, published 21 Jul 2026) - [CVE-2026-58436: Gitea quadratic-time DoS in Locale middleware via Accept-Language header](https://junglewise.ai/threats/cve-2026-58436-gitea-quadratic-time-dos-in-locale-middleware-via-accept-language) (high, CVSS 4, published 21 Jul 2026) - [CVE-2026-56657: Gitea SSH key parser denial of service in normalization loop](https://junglewise.ai/threats/cve-2026-56657-gitea-ssh-key-parser-denial-of-service-in-normalization-loop) (medium, CVSS 3.1, published 21 Jul 2026) - [CVE-2026-58437: Gitea repository visibility manipulation via Git push options](https://junglewise.ai/threats/cve-2026-58437-gitea-repository-visibility-manipulation-via-git-push-options) (high, CVSS 7.1, published 21 Jul 2026) - [CVE-2026-55987: Gitea account deactivation bypass via OAuth2 sign-in](https://junglewise.ai/threats/cve-2026-55987-gitea-account-deactivation-bypass-via-oauth2-sign-in) (high, CVSS 8.1, published 21 Jul 2026) - [CVE-2026-58435: Gitea LFS privilege escalation via deploy key impersonation](https://junglewise.ai/threats/cve-2026-58435-gitea-lfs-privilege-escalation-via-deploy-key-impersonation) (medium, CVSS 5.4, published 21 Jul 2026) - [CVE-2026-58420: Gitea Local File Inclusion in Migration Restore](https://junglewise.ai/threats/cve-2026-58420-gitea-local-file-inclusion-in-migration-restore) (medium, CVSS 4, published 21 Jul 2026) - [CVE-2026-55984: Gitea NULL pointer dereference in AddTime API](https://junglewise.ai/threats/cve-2026-55984-gitea-null-pointer-dereference-in-addtime-api) (low, CVSS 3.1, published 21 Jul 2026) - [CVE-2026-55982: Gitea OIDC userinfo scope bypass allows identity disclosure](https://junglewise.ai/threats/cve-2026-55982-gitea-oidc-userinfo-scope-bypass-allows-identity-disclosure) (medium, CVSS 4, published 21 Jul 2026) - [CVE-2026-58434: Gitea information disclosure via starred repository metadata after access revocation](https://junglewise.ai/threats/cve-2026-58434-gitea-information-disclosure-via-starred-repository-metadata) (medium, CVSS 4, published 21 Jul 2026) - [CVE-2026-54481: Gitea improper certificate validation in internal API client](https://junglewise.ai/threats/cve-2026-54481-gitea-improper-certificate-validation-in-internal-api-client) (high, CVSS 7.5, published 21 Jul 2026) - [CVE-2026-58417: Gitea information disclosure in private organization membership API](https://junglewise.ai/threats/cve-2026-58417-gitea-information-disclosure-in-private-organization-membership) (medium, CVSS 4, published 21 Jul 2026) - [CVE-2026-50105: Gitea authorization bypass in RSS and Atom feed handlers](https://junglewise.ai/threats/cve-2026-50105-gitea-authorization-bypass-in-rss-and-atom-feed-handlers) (medium, CVSS 4.3, published 21 Jul 2026) - [CVE-2026-58416: Gitea authorization bypass in Actions collaborative-owner access](https://junglewise.ai/threats/cve-2026-58416-gitea-authorization-bypass-in-actions-collaborative-owner-access) (medium, CVSS 6.3, published 21 Jul 2026) - [CVE-2026-42931: Gitea denial of service via unbounded memory allocation in NPM API](https://junglewise.ai/threats/cve-2026-42931-gitea-denial-of-service-via-unbounded-memory-allocation-in-npm) (medium, CVSS 6.5, published 21 Jul 2026) ## Most severe gitea.dev (Go) vulnerabilities - [CVE-2026-60004: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.](https://junglewise.ai/threats/cve-2026-60004-gitea-code-injection-in-diffpatch-api) (critical, exploited in the wild, CVSS 9.8, published 26 Aug 2026) - [CVE-2026-58443: Gitea public-only token scope bypass in pull request updates](https://junglewise.ai/threats/cve-2026-58443-gitea-public-only-token-scope-bypass-in-pull-request-updates) (critical, CVSS 9.6, published 21 Jul 2026) - [CVE-2026-56750: Gitea insufficient session expiration in Remember-Me auth token](https://junglewise.ai/threats/cve-2026-56750-gitea-insufficient-session-expiration-in-remember-me-auth-token) (critical, CVSS 4, published 21 Jul 2026) - [CVE-2026-57894: Gitea SSRF and repository exfiltration via Git HTTP redirects](https://junglewise.ai/threats/cve-2026-57894-gitea-ssrf-and-repository-exfiltration-via-git-http-redirects) (high, CVSS 8.5, published 21 Jul 2026) - [CVE-2026-55987: Gitea account deactivation bypass via OAuth2 sign-in](https://junglewise.ai/threats/cve-2026-55987-gitea-account-deactivation-bypass-via-oauth2-sign-in) (high, CVSS 8.1, published 21 Jul 2026) - [CVE-2026-58314: Gitea SSRF in webhooks and OpenID discovery](https://junglewise.ai/threats/cve-2026-58314-gitea-ssrf-in-webhooks-and-openid-discovery) (high, CVSS 7.7, published 21 Jul 2026) - [CVE-2026-34966: Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata](https://junglewise.ai/threats/cve-2026-34966-gitea-ssrf-via-migration-asset-downloads-bypasses-hostmatcher) (high, CVSS 7.6, published 5 Aug 2026) - [CVE-2026-54481: Gitea improper certificate validation in internal API client](https://junglewise.ai/threats/cve-2026-54481-gitea-improper-certificate-validation-in-internal-api-client) (high, CVSS 7.5, published 21 Jul 2026) - [CVE-2026-58437: Gitea repository visibility manipulation via Git push options](https://junglewise.ai/threats/cve-2026-58437-gitea-repository-visibility-manipulation-via-git-push-options) (high, CVSS 7.1, published 21 Jul 2026) - [CVE-2026-28740: Gitea authorization bypass in Git LFS object reuse](https://junglewise.ai/threats/cve-2026-28740-gitea-authorization-bypass-in-git-lfs-object-reuse) (high, CVSS 7.1, published 3 Jul 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 1 | 1 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "gitea.dev (Go) vulnerabilities", https://junglewise.ai/threats/technologies/gitea-dev, 13 November 2026.