CVE Vulnerability Catalog

The vulnerability allows bypassing the release attachment extension allowlist via the web release edit form. This is a variant of CVE-2025-68939.

The vulnerability leaks the member list of private organizations via the /members API endpoint. This is an incomplete fix for PR #38145.

The vulnerability in OAuth token introspection returns metadata of tokens issued to other clients, violating section 4 of RFC 7662.

The vulnerability allows Local File Inclusion via file:// URI in the Migration Restore function. An attacker can read arbitrary files from the server's filesystem.

The vulnerability in the REST API exposes organization membership of private organizations to the public. Unauthorized individuals can obtain information about members of private organizations.

The vulnerability in Fork-PR Actions tasks allows reading a third private repository via the collaborative-owner branch. A missing fork-PR guard enables this.

Two Server-Side Request Forgery (SSRF) findings in Gitea 1.26.2. They allow an attacker to make requests from the server to internal resources.

The vulnerability enables cross-repository information disclosure via Org-Level Actions Run/Job APIs. An attacker can obtain data from other repositories.

The vulnerability in repository migration follows Git HTTP redirects after URL allow/block validation, enabling internal Git repository exfiltration.

The vulnerability allows re-linking attachments to issues/comments across repositories, potentially exposing private attachment content.

The vulnerability causes denial of service (CPU and memory exhaustion) via O(N^2) string concatenation during Debian package upload.

Theft of the Remember-Me token in Gitea does not invalidate the attacker's session, allowing continued unauthorized access.

The SSH key parser in Gitea is vulnerable to denial of service, potentially leading to system overload.

The vulnerability allows privilege escalation via access token scope escalation in the API.

A public-only scope token can bypass restrictions on limited-visibility owners (Repository and Package categories) — residual after CVE-2026-25714 / PR #37118.

OAuth2 sign-in can reactivate an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009).

The Email Management API bypasses ManageCredentials feature restrictions, allowing unauthorized operations on email addresses.

Null pointer dereference in the AddTime API causes authenticated denial of service.

The OIDC userinfo endpoint returns identity claims without enforcing API token scopes.

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an 'in the middle' position can send specially crafted data to a server causing a persistent denial of service.