Threat Intelligence Database

Gitea versions prior to 1.26.0 contain an authorization vulnerability where errors in bufio.Scanner during pre-receive hook input processing do not cause the system to fail closed. This allows oversized input to bypass branch-protection checks, potentially undermining repository security controls.

Gitea versions prior to 1.25.5 contain a vulnerability that allows a user to change another user's primary email address without proper authorization. This issue represents an authorization bypass flaw in the Gitea Open Source Git Server. No official patch or remediation guidance has been provided yet.

Gitea versions prior to 1.25.5 have a vulnerability where the migration HTTP transport is not used for LFS push and sync mirror operations. This omission allows these LFS requests to bypass the configured migration transport protections, potentially leading to unauthorized access or actions.

Gitea versions prior to 1.25.5 have a vulnerability where the OAuth2 PKCE S256 challenge method is not correctly persisted during authorization. This flaw allows token exchange to occur without the expected verifier check, potentially weakening the OAuth2 authorization process.

Gitea versions prior to 1.25.5 contain an authorization bypass vulnerability where tracked-time entries are looked up by time ID without properly scoping to the issue specified in the request URL. This allows an attacker to attempt deletion of tracked-time entries associated with other issues, potentially leading to unauthorized data modification.

CVE-2026-25718 is a vulnerability in Gitea Open Source Git Server versions before 1.25.5. It involves improper path resolution during template repository generation, which allows template processing to read or write files through symbolic links or other non-regular paths. This can lead to unauthorized file access or modification.

Gitea versions prior to 1.25.5 have a vulnerability due to improper input validation in repository creation fields. This includes missing constraints on length-limited template fields and values related to trust models or object formats. No official patch or remediation guidance is provided yet.

Gitea versions prior to 1.25.5 contain a vulnerability involving insufficient permission checks when listing tracked time entries. This weakness could allow unauthorized users to access time tracking information that should be restricted. No CVSS score or detailed impact metrics are provided. No patch or official remediation guidance is currently available from the vendor.