Affected by GO-2025-4258
and 11 other vulnerabilities
GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea
GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea
GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea
GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea
GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea
GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea
GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea
GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea
GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea
GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea
GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea
GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea
DefaultAvatarSize is the target CSS pixel size for avatar generation. It is
multiplied by setting.Avatar.RenderedSizeFactor and the resulting size is the
usual size of avatar image saved on server, unless the original file is smaller
than the size after resizing.
HashAvatar will generate a unique string, which ensures that when there's a
different unique ID while the data is the same, it will generate a different
output. It will generate the output according to:
HEX(HASH(uniqueID || - || data))
The hash being used is SHA256.
The sole purpose of the unique ID is to generate a distinct hash Such that
two unique IDs with the same data will have a different hash output.
The "-" byte is important to ensure that data cannot be modified such that
the first byte is a number, which could lead to a "collision" with the hash
of another unique ID.
ProcessAvatarImage process the avatar image data, crop and resize it if necessary.
the returned data could be the original image if no processing is needed.
Affected by 
Documentation
¶
Source Files
Directories