GO-2026-5286: Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer in code.gitea.io/gitea
GO-2026-5299: Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication in code.gitea.io/gitea
GO-2026-5321: Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens in code.gitea.io/gitea
GO-2026-5334: Gitea: Token scope bypass on web archive download endpoint in code.gitea.io/gitea
GO-2026-5365: Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration in code.gitea.io/gitea
GO-2026-5448: Gitea: Open Redirect via redirect_to in code.gitea.io/gitea
GO-2026-5510: Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo in code.gitea.io/gitea
GO-2026-5721: Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes in code.gitea.io/gitea
GO-2026-6017: Gitea has insufficient permission checks for Composer package source links in code.gitea.io/gitea
GO-2026-6029: Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea
GO-2026-6030: Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea
GO-2026-6031: Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea
GO-2026-6041: Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea
GO-2026-6043: Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea
GO-2026-6046: Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories in code.gitea.io/gitea
GO-2026-6051: Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` in code.gitea.io/gitea
GO-2026-6056: Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts in code.gitea.io/gitea
GO-2026-6057: Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface in code.gitea.io/gitea
GO-2026-6060: Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea
GO-2026-6074: Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea
GO-2026-6075: Gitea: SSRF via HTTP Redirect in Repository Migration in code.gitea.io/gitea
GO-2026-6076: Gitea: Unauthorized Access to Labels of Private Organizations in code.gitea.io/gitea
GO-2026-6077: Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in code.gitea.io/gitea
GO-2026-6080: Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag in go-gitea/gitea
GO-2026-6081: Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private in code.gitea.io/gitea
CmdArg represents a command argument for git command, and it will be used for the git command directly without any further processing.
In most cases, you should use the "AddXxx" functions to add arguments, but not use this type directly.
Casting a risky (user-provided) string to CmdArg would cause security issues if it's injected with a "--xxx" argument.
Affected by 
Documentation
¶
Source Files