Gitea versions from 1.5.0 up to but not including 1.26.3 contain a vulnerability in the TOTP single-use enforcement mechanism. This flaw allows a valid TOTP code to be reused multiple times during web two-factor authentication and Basic Auth X-Gitea-OTP authentication flows. The vulnerability is classified under CWE-294 (Improper Authentication) and has a CVSS 3.1 score of 7.1, indicating high severity.
Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a Docker-backed runner can create a job container with host namespaces and broad capabilities and escape to the host as root despite privileged mode being disabled.
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
CVE-2026-20904 is a medium severity vulnerability in the Gitea open source Git server where authenticated users can improperly toggle the visibility of other users' OpenID URIs due to insufficient ownership validation. This improper access control flaw allows attackers to alter identity visibility settings without authorization, potentially impacting user privacy and trust. The vulnerability requires authentication but no user interaction beyond that, and does not affect confidentiality directly but impacts integrity of user settings. There are no known exploits in the wild yet. European organizations using Gitea for source code management should assess their exposure and apply mitigations promptly. The vulnerability is particularly relevant for countries with strong open source adoption and active software development communities. Mitigation involves restricting access controls, auditing user permissions, and monitoring changes to OpenID visibility settings. No official patch links are currently available, so organizations should follow Gitea updates closely. Overall, this vulnerability highlights the importance of strict access control enforcement in collaborative development platforms.
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
CVE-2026-20888 is a medium severity vulnerability in the Gitea Open Source Git Server where improper access control allows users with read access to pull requests to cancel scheduled auto-merges initiated by other users. This flaw arises from insufficient authorization checks in the web interface when handling auto-merge cancellations. Exploitation does not require user interaction but does require at least read-level privileges. The vulnerability impacts the integrity of the development workflow by enabling unauthorized interference with merge operations, though it does not affect confidentiality or availability. No known exploits are currently reported in the wild. European organizations using Gitea for source code management should review their access control policies and update or patch affected versions once fixes are available.
CVE-2026-20883 is an improper access control vulnerability in Gitea's stopwatch API that allows users whose access to private repositories has been revoked to still view issue titles and repository names via previously started stopwatches. This vulnerability affects Gitea, an open-source Git server widely used for source code management. The flaw arises because the stopwatch API does not re-validate repository permissions after access revocation, leading to unauthorized information disclosure. The CVSS score of 6.5 indicates a medium severity with high confidentiality impact but no integrity or availability impact. Exploitation requires at least low privileges and no user interaction, making it moderately easy to exploit. European organizations using Gitea for private repository hosting could face information leakage risks, potentially exposing sensitive project details. Mitigation involves updating Gitea to a fixed version once available, auditing stopwatch API usage, and restricting stopwatch functionality to trusted users. Countries with strong software development sectors and high adoption of open-source tools, such as Germany, France, and the UK, are most likely to be affected. Overall, defenders should prioritize patching and access control reviews to prevent unauthorized data exposure through this vulnerability.
CVE-2026-20800 is a medium-severity vulnerability in the Gitea Open Source Git Server's notification API, where repository access permissions are not re-validated when returning notification details. This flaw allows users who have had their access to private repositories revoked to still view issue and pull request titles through previously received notifications. The vulnerability impacts confidentiality but does not affect integrity or availability, and it requires the attacker to have had prior access to the repository. No user interaction is needed once access is revoked, and exploitation can be performed remotely with low complexity. There are no known exploits in the wild, and no patches have been released yet. European organizations using Gitea for private repository management should be aware of potential sensitive information exposure risks. Mitigation involves auditing notification access controls, restricting notification content, and monitoring user access revocations closely. Countries with significant open source development communities and high adoption of Gitea, such as Germany, France, and the Netherlands, are more likely to be affected.
Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.
CVE-2026-0798 is a low-severity improper access control vulnerability in the Gitea open source Git server. It causes release notification emails for private repositories to be sent to users who no longer have access, potentially leaking release titles, tags, and content. This occurs when a repository is changed from public to private but prior watchers still receive notifications. Exploitation requires the user to have had prior access and involves user interaction (email receipt). The vulnerability impacts confidentiality but not integrity or availability. No known exploits are reported in the wild. European organizations using Gitea for private code hosting should review notification settings and access controls to prevent unintended information disclosure.
