gitea -- Multiple vulnerabilities

2026-08-16 · CVE-2026-23603, CVE-2026-42931, CVE-2026-50105, CVE-2026-54481, CVE-2026-55982, CVE-2026-55984, CVE-2026-55986, CVE-2026-55987, CVE-2026-56443, CVE-2026-56654, CVE-2026-56657, CVE-2026-56750, CVE-2026-56755, CVE-2026-57886, CVE-2026-57894, CVE-2026-57897, CVE-2026-58314, CVE-2026-58416, CVE-2026-58417, CVE-2026-58420, CVE-2026-58425, CVE-2026-58427, CVE-2026-58428, CVE-2026-58429, CVE-2026-58431, CVE-2026-58432, CVE-2026-58433, CVE-2026-58434, CVE-2026-58435, CVE-2026-58436, CVE-2026-58437, CVE-2026-58438, CVE-2026-58439, CVE-2026-58440, CVE-2026-58441, CVE-2026-58442, CVE-2026-58443, CVE-2026-58444, CVE-2026-58445, CVE-2026-58507, CVE-2026-58508, CVE-2026-58510, CVE-2026-58511, CVE-2026-59763, CVE-2026-59765 · VuXML entry

Gitea reports This release contains fixes for 45 security issues, including privilege escalation, remote denial of service, server-side request forgery, authorization and token scope bypasses, and information disclosure vulnerabilities. Please upgrade as soon as possible.

Affected versions

• gitea < 1.27.0

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.