ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving...
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized ac...
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
SQL injection in the Zalktis accounting application via
trading-partner-controlled text fields in received electronic invoices. When
importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis
concatenates partner-controlled values directly into SQL statement text using
string conca...
Webhook Authorization Header Returned in Plaintext via API
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
Private Repository Existence Disclosure via go-get Meta Endpoint
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Public-only repository tokens can update private PR head branches
Repository migration SSRF via multi-answer DNS allow-list bypass
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Repository Visibility Manipulation via Git Push Options
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Gitea LFS Deploy-Key Privilege Escalation
Private Repository Metadata Remains Accessible After Access Revocation
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Public-only API token restriction is not enforced on team API routes
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
Local File Inclusion via file:// URI in Migration Restore
REST API exposes organization membership of private organizations to public
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Two SSRF findings in Gitea 1.26.2
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
Cross-repository issue/comment attachment re-linking can expose private attachment content
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea SSH Key Parser Denial of Service
Privilege Escalation via Access Token Scope Escalation in API
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
Email Management API Bypasses ManageCredentials Feature Restrictions
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
CVE-2026-55402 is an out of bounds read vulnerability in Secure Access
servers prior to version 14.57. Attackers with an ‘in the middle’
position can send specially crafted data to a server causing a
persistent denial of service.
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...