gitea -- multiple vulnerabilities

2026-06-28 · CVE-2026-27783, CVE-2026-25714, CVE-2026-20706, CVE-2026-27771, CVE-2026-28744, CVE-2026-28699, CVE-2026-26231, CVE-2026-20896, CVE-2026-22874, CVE-2026-27775, CVE-2026-27761, CVE-2026-25038, CVE-2026-24451, CVE-2026-20779, CVE-2026-28740 · VuXML entry

The Gitea team reports: CVE-2026-27783: incorrect read permission check CVE-2026-25714: public-only token filtering bypass CVE-2026-20706: missing token scope checking CVE-2026-27771: unauthenticated access to private container images CVE-2026-28744: git smart HTTP request scope bug CVE-2026-28699: basic auth bug CVE-2026-26231: maintainer edit permission escalation CVE-2026-20896: reverse proxy trusted proxies …

Affected versions

• gitea < 1.26.4

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.