internal

Sep 24, 2025 GO-2025-4261

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Jan 22, 2026 GO-2025-4261

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Dec 18, 2025 GO-2025-4261 +9 more

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Nov 22, 2025 GO-2025-4261 +9 more

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Nov 4, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Oct 29, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Sep 25, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Apr 28, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Oct 25, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Sep 11, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Aug 13, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Aug 4, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jul 15, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jun 20, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jun 19, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jun 10, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Apr 29, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Dec 16, 2024 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

May 12, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Apr 7, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Mar 24, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Mar 4, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Feb 19, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Feb 6, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Feb 5, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jan 10, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jan 9, 2025 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Dec 17, 2024 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Mar 28, 2024 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Dec 13, 2024 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Dec 11, 2024 GO-2025-4258 +11 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Nov 25, 2024 GO-2025-4258 +12 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Oct 9, 2024 GO-2025-4258 +12 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Sep 5, 2024 GO-2025-4258 +13 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jul 4, 2024 GO-2025-4258 +15 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

May 27, 2024 GO-2024-3056 +16 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Apr 27, 2024 GO-2024-3056 +16 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Mar 28, 2024 GO-2024-3056 +16 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Sep 20, 2023 GO-2024-3056 +16 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Apr 16, 2024 GO-2024-3056 +16 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Mar 25, 2024 GO-2024-3056 +16 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Mar 22, 2024 GO-2024-3056 +16 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Mar 13, 2024 GO-2024-3056 +16 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Feb 26, 2024 GO-2024-3056 +17 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Feb 22, 2024 GO-2024-3056 +17 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Feb 1, 2024 GO-2024-3056 +17 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jan 17, 2024 GO-2024-3056 +17 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Dec 21, 2023 GO-2024-3056 +17 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Dec 12, 2023 GO-2024-3056 +17 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Nov 26, 2023 GO-2024-3056 +18 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Nov 14, 2023 GO-2024-3056 +18 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Oct 19, 2023 GO-2024-3056 +18 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Oct 6, 2023 GO-2024-3056 +18 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Sep 20, 2023 GO-2024-3056 +18 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jun 7, 2023 GO-2024-3056 +18 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Nov 26, 2023 GO-2024-3056 +18 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Oct 3, 2023 GO-2024-3056 +18 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Sep 8, 2023 GO-2024-3056 +18 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Aug 20, 2023 GO-2024-3056 +18 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jul 29, 2023 GO-2024-3056 +18 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jul 22, 2023 GO-2024-3056 +18 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jul 16, 2023 GO-2024-3056 +19 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jun 24, 2023 GO-2024-3056 +19 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jun 23, 2023 GO-2024-3056 +19 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jun 7, 2023 GO-2024-3056 +19 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Feb 22, 2023 GO-2024-3056 +19 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Jul 4, 2023 GO-2024-3056 +19 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

May 3, 2023 GO-2023-1894 +20 more

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Apr 27, 2023 GO-2023-1894 +20 more

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Apr 13, 2023 GO-2023-1894 +20 more

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Mar 20, 2023 GO-2023-1894 +20 more

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Changes in this version

+ type CmdArg string

Mar 5, 2023 GO-2023-1894 +20 more

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

Feb 22, 2023 GO-2023-1894 +20 more

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

  GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

  GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

  GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

  GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

  GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

  GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

  GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

  GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

  GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

  GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea