🚨 CVE-2026-24059
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.
🎖@cveNotify
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.
🎖@cveNotify
Gitea Blog
Gitea 1.25.5 is released
We're excited to announce the release of Gitea 1.25.5 We strongly recommend all users upgrade to this version, as it includes important security fixes, numerous bug fixes, and overall stability improvements. CVE 2026 25779: Prevent redirect bypasses via backslash…
🚨 CVE-2026-24791
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
🎖@cveNotify
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
🎖@cveNotify
Gitea Blog
Gitea 1.26.2 is released
We are excited to announce the release of Gitea 1.26.2 We strongly recommend all users upgrade to this version, as it contains a number of security fixes alongside important bug fixes and stability improvements. CVE 2026 27783: fix permissions : Fix reading…
🚨 CVE-2026-50105
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
🎖@cveNotify
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
🎖@cveNotify
🚨 CVE-2026-54481
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
🎖@cveNotify
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
🎖@cveNotify
🚨 CVE-2026-55982
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
🎖@cveNotify
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
🎖@cveNotify
🚨 CVE-2026-55984
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
🎖@cveNotify
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
🎖@cveNotify
🚨 CVE-2026-55987
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
🎖@cveNotify
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
🎖@cveNotify
🚨 CVE-2026-56443
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
🎖@cveNotify
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
🎖@cveNotify
🚨 CVE-2026-56755
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
🎖@cveNotify
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
🎖@cveNotify
🚨 CVE-2026-57886
Cross-repository issue/comment attachment re-linking can expose private attachment content
🎖@cveNotify
Cross-repository issue/comment attachment re-linking can expose private attachment content
🎖@cveNotify
🚨 CVE-2026-57894
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
🎖@cveNotify
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
🎖@cveNotify
🚨 CVE-2026-58416
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
🎖@cveNotify
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
🎖@cveNotify
🚨 CVE-2026-58417
REST API exposes organization membership of private organizations to public
🎖@cveNotify
REST API exposes organization membership of private organizations to public
🎖@cveNotify
🚨 CVE-2026-58425
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
🎖@cveNotify
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
🎖@cveNotify