CVE Vulnerability Catalog

Webhook Authorization Header Returned in Plaintext via API.

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private.

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation).

Private Repository Existence Disclosure via go-get Meta Endpoint.

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API.

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents.

Public-only repository tokens can update private PR head branches.

Repository migration SSRF via multi-answer DNS allow-list bypass.

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL.

Webhooks created by a collaborator keep firing after their repo access is revoked, enabling ongoing real-time exfiltration of private repo content. The issue stems from incomplete revocation cleanup in `DeleteCollaboration`.

Branch protection can be bypassed via PR retargeting, preserving a stale `official` approval flag. This allows changes to be pushed to protected branches without the required approval.

A cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access. There is a lack of proper object-level authorization.

The vulnerability allows manipulation of repository visibility via Git push options. An attacker can change repository visibility (e.g., from private to public) without proper permissions.

ParseAcceptLanguage in the Locale middleware causes a quadratic-time DoS on unauthenticated requests. Sending specially crafted Accept-Language headers can overload the server.

A vulnerability in Gitea LFS allows privilege escalation via deploy keys. A person with a deploy key can gain higher privileges than intended.

Private repository metadata remains accessible after access revocation. This means that information about the repository (e.g., name, description) may still be visible to users who lost permissions.

The team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting. This means a user without proper permissions can change repository-team assignments.

In code.gitea.io/gitea, there is missing authorization and authorization bypass through user-controlled key, incorrect permission assignment for critical resources, and exposure of sensitive information to an unauthorized actor.

The public-only API token restriction is not enforced on team API routes. This means a token intended for public access only can access team data that should be private.

The vulnerability allows bypassing the public-only scope of personal access tokens in organization and permission endpoints. This means a token intended only for public operations can access operations requiring broader privileges.