Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Repository Visibility Manipulation via Git Push Options

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Gitea LFS Deploy-Key Privilege Escalation

Private Repository Metadata Remains Accessible After Access Revocation

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

Public-only API token restriction is not enforced on team API routes

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component.

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Permanent Fork PR Workflow Approval Gate Bypass

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Local File Inclusion via file:// URI in Migration Restore

A weakness has been identified in Tenda i3 1.0.0.6(2204). The affected element is the function R7WebsSecurityHandler of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.