# Gitea vulnerabilities Source: https://junglewise.ai/threats/technologies/gitea Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/gitea.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 177 vulnerabilities in Gitea: 0 in the last 7 days and 87 in the last 90 days, 15 of them critical and 1 exploited in the wild. The most recent, CVE-2026-120263, was published on 1 November 2026. 56 vulnerabilities in the last four weeks, up 87% on the four before (30). 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 56 - Last 90 days: 87 - All time: 177 (15 critical, 1 exploited in the wild) ## About Gitea Lightweight self-hosted Git service written in Go. ## Latest Gitea vulnerabilities - [CVE-2026-120263: Gitea account takeover via OAuth2 auto-linking](https://junglewise.ai/threats/cve-2026-120263-when-oauth2-client-account-linking-is-set-to-auto-not-the) (info, published 1 Nov 2026) - [CVE-2026-119627: Gitea limited-visibility profile disclosure via public-only token](https://junglewise.ai/threats/cve-2026-119627-the-web-profile-and-rss-atom-feed-routes-of-users-and) (info, published 1 Nov 2026) - [CVE-2026-119625: Gitea token scope bypass in web routes](https://junglewise.ai/threats/cve-2026-119625-the-username-web-route-accepted-personal-access-tokens-over-http) (info, published 1 Nov 2026) - [CVE-2026-119533: Gitea project boards information disclosure of private pull requests](https://junglewise.ai/threats/cve-2026-119533-repository-and-organization-project-boards-listed-the-pull) (info, published 1 Nov 2026) - [CVE-2026-119441: Gitea API token scope bypass in repository deletion](https://junglewise.ai/threats/cve-2026-119441-delete-api-v1-orgs-org-repos-deletes-all-repositories-of-an) (info, published 1 Nov 2026) - [CVE-2026-118504: Gitea REST API archived repository modification bypass](https://junglewise.ai/threats/cve-2026-118504-the-web-interface-blocks-issue-and-pull-request-changes-on) (info, published 1 Nov 2026) - [CVE-2026-118395: Gitea public-only token scope bypass in repository creation](https://junglewise.ai/threats/cve-2026-118395-gitea-1-27-3-stopped-personal-access-tokens-restricted-to-public) (info, published 1 Nov 2026) - [CVE-2026-118394: Gitea OAuth2 userinfo endpoint private group disclosure](https://junglewise.ai/threats/cve-2026-118394-the-oauth2-userinfo-endpoint-login-oauth-userinfo-decided) (info, published 1 Nov 2026) - [CVE-2026-118386: Gitea Actions workflow privilege escalation via pull request review](https://junglewise.ai/threats/cve-2026-118386-workflows-triggered-by-a-pull-request-review-were-read-from-the) (info, published 1 Nov 2026) - [CVE-2026-117685: Gitea OCI cross-repository blob mount token scope bypass](https://junglewise.ai/threats/cve-2026-117685-the-oci-registry-s-cross-repository-blob-mount-checked-the) (info, published 1 Nov 2026) - [CVE-2026-117677: Gitea Helm chart decompression denial of service](https://junglewise.ai/threats/cve-2026-117677-when-parsing-an-uploaded-helm-chart-gitea-decompressed-the) (info, published 1 Nov 2026) - [CVE-2026-117649: Gitea issue timeline API information disclosure on linked issues](https://junglewise.ai/threats/cve-2026-117649-the-issue-timeline-api-and-the-web-issue-page-hid-cross) (info, published 1 Nov 2026) - [CVE-2026-117646: Gitea profile tabs information disclosure via public-only token scope bypass](https://junglewise.ai/threats/cve-2026-117646-the-repositories-stars-and-watching-tabs-of-user-profiles-and) (info, published 1 Nov 2026) - [CVE-2026-117635: Gitea admin API token scope bypass](https://junglewise.ai/threats/cve-2026-117635-the-api-v1-admin-route-group-did-not-enforce-the-public-only) (info, published 1 Nov 2026) - [CVE-2026-116474: Gitea Actions job token privilege escalation via GPG key registration](https://junglewise.ai/threats/cve-2026-116474-the-gitea-token-of-a-gitea-actions-job-authenticates-as-the) (info, published 1 Nov 2026) - [CVE-2026-116296: Gitea API mutation enforcement bypass on archived repositories](https://junglewise.ai/threats/cve-2026-116296-the-api-routes-for-releases-release-assets-milestones-and) (info, published 1 Nov 2026) - [CVE-2026-116289: Gitea personal access token scope bypass in Actions runner registration](https://junglewise.ai/threats/cve-2026-116289-gitea-did-not-reject-personal-access-tokens-restricted-to-public) (info, published 1 Nov 2026) - [CVE-2026-114199: Gitea heatmap API token scope bypass](https://junglewise.ai/threats/cve-2026-114199-get-api-v1-users-username-heatmap-computed-the-contribution) (info, published 1 Nov 2026) - [CVE-2026-113429: Gitea Actions artifact uploads stored Content-Encoding as Content-Type](https://junglewise.ai/threats/cve-2026-113429-legacy-v1-to-v3-actions-artifact-uploads-stored-the-request-s) (info, published 1 Nov 2026) - [CVE-2026-112887: Gitea Actions task tokens privilege escalation in REST API](https://junglewise.ai/threats/cve-2026-112887-gitea-actions-task-tokens-authenticate-to-the-rest-api-as-a) (info, published 1 Nov 2026) - [CVE-2026-97859: Gitea API visibility check bypass in user endpoints](https://junglewise.ai/threats/cve-2026-97859-seven-gitea-api-routes-under-api-v1-users-username-followers) (info, published 18 Oct 2026) - [CVE-2026-97204: Gitea label deletion authorization bypass in repository](https://junglewise.ai/threats/cve-2026-97204-deleting-a-label-compared-the-id-of-the-repository-in-the-request) (info, published 18 Oct 2026) - [CVE-2026-110494: Gitea release attachment access control bypass](https://junglewise.ai/threats/cve-2026-110494-adding-attachments-to-a-release-checked-the-repository-and) (info, published 18 Oct 2026) - [CVE-2026-110324: Gitea user profile information disclosure via POST request](https://junglewise.ai/threats/cve-2026-110324-the-visibility-check-of-gitea-user-profiles-was-applied-to-get) (info, published 18 Oct 2026) - [CVE-2026-110311: Gitea API information disclosure in draft release attachments](https://junglewise.ai/threats/cve-2026-110311-creating-a-draft-release-through-the-api-returned-an-assets-list) (info, published 18 Oct 2026) ## Most severe Gitea vulnerabilities - [CVE-2026-60004: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.](https://junglewise.ai/threats/cve-2026-60004-gitea-code-injection-in-diffpatch-api) (critical, exploited in the wild, CVSS 9.8, published 26 Aug 2026) - [CVE-2026-59774: Gitea Org-mode markup arbitrary file read via INCLUDE directive](https://junglewise.ai/threats/cve-2026-59774-gitea-s-org-mode-markup-renderer-processes-include-directives) (critical, CVSS 9.8, published 14 Oct 2026) - [CVE-2026-26292: Gitea migration transport bypass in LFS mirror operations](https://junglewise.ai/threats/cve-2026-26292-gitea-migration-transport-bypass-in-lfs-mirror-operations) (critical, CVSS 9.8, published 3 Jul 2026) - [CVE-2026-27780: Gitea branch protection bypass via bufio.Scanner error handling in pre-receive hooks](https://junglewise.ai/threats/cve-2026-27780-gitea-branch-protection-bypass-via-bufio-scanner-error-handling) (critical, CVSS 9.8, published 3 Jul 2026) - [CVE-2026-58443: Gitea public-only token scope bypass in pull request updates](https://junglewise.ai/threats/cve-2026-58443-gitea-public-only-token-scope-bypass-in-pull-request-updates) (critical, CVSS 9.6, published 21 Jul 2026) - [CVE-2026-22874: Gitea SSRF via incomplete hostmatcher allow-list filtering](https://junglewise.ai/threats/cve-2026-22874-gitea-ssrf-via-incomplete-hostmatcher-allow-list-filtering) (critical, CVSS 9.6, published 3 Jul 2026) - [CVE-2026-58426: Gitea Actions HMAC ambiguity in Artifacts V4 signed URLs](https://junglewise.ai/threats/cve-2026-58426-gitea-actions-hmac-ambiguity-in-artifacts-v4-signed-urls) (critical, CVSS 9.6, published 3 Jul 2026) - [CVE-2026-25718: Gitea improper link resolution in template repository generation](https://junglewise.ai/threats/cve-2026-25718-gitea-improper-link-resolution-in-template-repository-generation) (critical, CVSS 9.1, published 3 Jul 2026) - [CVE-2026-22547: Gitea improper input validation in repository creation fields](https://junglewise.ai/threats/cve-2026-22547-gitea-improper-input-validation-in-repository-creation-fields) (critical, CVSS 9.1, published 3 Jul 2026) - [CVE-2026-26247: Gitea OAuth2 PKCE S256 verifier bypass](https://junglewise.ai/threats/cve-2026-26247-gitea-oauth2-pkce-s256-verifier-bypass) (critical, CVSS 9.1, published 3 Jul 2026) ## Vulnerabilities per week 56 vulnerabilities in the last four weeks, up 87% on the four before (30). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 1 | 1 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 30 | 0 | 0 | | 12 Oct 2026 | 36 | 1 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 20 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Gitea vulnerabilities", https://junglewise.ai/threats/technologies/gitea, 12 November 2026.